CVE-2026-40515 OpenHarness Permission Bypass via grep and glob root argument

High 8.7 Published 17 Apr 2026 Updated 14 Jul 2026

Attackers can bypass path restrictions in OpenHarness to read sensitive local files using grep and glob tools.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-40515?

CVE-2026-40515 is a high-severity missing authorization vulnerability in HKUDS OpenHarness, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.

Weakness: CWE-863

Which versions are affected by CVE-2026-40515?

It affects 1 product.

Products include Hkuds Openharness.

How do I fix CVE-2026-40515?

No fix has been published for CVE-2026-40515 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-40515 being exploited?

There is no known exploitation of CVE-2026-40515 in the wild and no public exploit code.

Sources

Also known as GHSA-9gpm-2v37-f3mp.