OpenHarness Flaw Exposes Sensitive Files via Path Normalization Bypass

The National Vulnerability Database has detailed CVE-2026-40515, a high-severity (CVSS 7.5) permission bypass vulnerability in OpenHarness, affecting versions prior to commit bd4df81. This flaw stems from incomplete path normalization within OpenHarness’s permission checker, enabling attackers to bypass configured path restrictions.

Attackers can exploit this by invoking built-in grep and glob tools with sensitive root directories. Because these directories are not properly evaluated against established path rules, the vulnerability allows for the disclosure of sensitive local file content, key material, configuration files, and directory listings, circumventing intended security controls.

This isn’t just a theoretical bypass; it’s a direct route to critical data. Defenders need to recognize that incomplete path normalization is a persistent attack vector. It’s a subtle but powerful way to subvert access controls, and it frequently underpins data exposure incidents. The attacker’s calculus here is simple: find a trusted function that can be fed untrusted input, and the system does the rest.