CVE-2026-40515

CVE-2026-40515 is a permission bypass vulnerability in OpenHarness prior to commit bd4df81 that exploits incomplete path normalization in the permission checker to allow unauthorized file disclosure. Attackers can leverage built-in grep and glob tools to access sensitive root directories that bypass configured path restrictions, potentially exposing sensitive files, cryptographic material, and configuration data. The vulnerability requires no authentication or user interaction and can be exploited remotely, receiving a CVSS 3.1 score of 7.5 (HIGH) with a confidentiality impact rating of HIGH. The exploit has not been publicly disclosed or added to CISA's Known Exploited Vulnerabilities catalog, and community attention remains minimal based on its low EPSS score of 0.00039 and inactive status on vulnerability hot lists. Organizations running OpenHarness should prioritize updating to the patched version to eliminate the path normalization flaw before threat actors develop weaponized exploits.