CVSS 4.0
7.1 highCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NCVE-2026-92750
High (7.1). EPSS 0.3% chance of exploitation in the next 30 days.
Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.
Severity
CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 20% of CVEs (scores of 2026-10-31)
- CWE
- CWE-862
- Published
- Modified
- Record from
- the NVD, synced
References
- https://github.com/harness/harness
- https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/find.go#L25-L41
- https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/list.go#L37
- https://github.com/harness/harness/issues/3697
- https://www.vulncheck.com/advisories/harness-through-3.3.0-missing-access-control-via-infraproviders-endpoint