---
id: CVE-2026-40515
title: OpenHarness Permission Bypass via grep and glob root argument
summary: "OpenHarness before commit\_bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and …"
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-863
vendor: HKUDS
product: OpenHarness
affected:
  - OpenHarness < bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-17T16:33:48.805185Z'
published: '2026-04-17'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:54.152Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-40515'
references:
  - url: 'https://github.com/HKUDS/OpenHarness/pull/92'
  - url: >-
      https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
  - url: >-
      https://www.vulncheck.com/advisories/openharness-permission-bypass-via-grep-and-glob-root-argument
tags:
  - cve.org
epss: 0.0023
epssPercentile: 0.13954
ingestedAt: '2026-11-08T14:51:22.442Z'
---

## Overview

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.

## Affected

- `OpenHarness < bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.