CVE-2026-92750

MediumCVSS 6.5/10Last modified Sep 24, 2026

Description

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
harness	harness	<= 3.3.0

References

Timeline

Published: Sep 16, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-927518.1CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of CVE-2026-927528.3metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing re CVE-2026-927537.1PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filte CVE-2026-927544.3PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization deco CVE-2026-927565.5Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption se CVE-2026-927575.5Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable CVE-2026-927585.5If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in CVE-2026-927596.5SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the CVE-2026-927606.5Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscr CVE-2026-927618.8WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Att CVE-2026-927628.8Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side aut CVE-2026-927638.1Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint.