CVE-2026-92750 json
Harness through 3.3.0 Missing Access Control via infraproviders endpoint
published 2026-09-16 53 d ago modified 2026-09-24 45 d ago also EUVD-2026-81022
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 52 d ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- harness harness
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/harness/harness/issues/3697
issue-tracking
-
github.com
/harness/harness
product
-
github.com
/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/find.go#L25-L41
technical-description
-
github.com
/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/list.go#L37
technical-description
-
vulncheck.com
/advisories/harness-through-3.3.0-missing-access-control-via-infraproviders-endpoint
third-party-advisory
Sources
- CVE List CVE-2026-92750
- NVD CVE-2026-92750
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.