Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization in the permission checker. Attackers can invoke the built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules, allowing disclosure of sensitive local file content, key material, configuration files, or directory contents despite configured path restrictions.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40515 OpenHarness before commit bd4df81 contains a permission bypass vulnerability that allows attackers to read sensitive files by exploiting incomplete path normalization… https://www.cve.org/CVERecord?id=CVE-2026-40515
Post summary
The post announces a new OpenHarness permission bypass (CVE-2026-40515) that allows reading sensitive files via incomplete path normalization.
CVE-2026-40515 Permission Bypass in OpenHarness Before Commit bd4df81 Allows Sensitive File Disclosure https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40515
Post summary
CVE-2026-40515 is a permission bypass in OpenHarness before commit bd4df81 that allows sensitive file disclosure. No PoC, exploit, patch, or active exploitation details are provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hkuds | openharness | - | - | - |