CVE-2026-22682

OVERVIEW CVE-2026-22682 is an improper access control vulnerability affecting OpenHarness prior to commit 166fcfe. The flaw exists in built-in file tools (read_file, write_file, edit_file, and notebook_edit) due to inconsistent parameter handling in permission enforcement. This vulnerability allows attackers who can influence agent tool execution to bypass deny rules and access arbitrary files outside the intended repository scope. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.1 (HIGH) with a local attack vector requiring low privileges and no user interaction. Exploitation requires local access but can result in high-impact compromise of confidentiality and integrity. Threat actors could read sensitive files such as configuration data, credentials, and SSH keys, or create and overwrite files in restricted host paths when the tool operates in full_auto mode. EXPLOITATION STATUS Currently, there is no indication of active exploitation in the wild. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on vulnerability hotlists. However, the EPSS score of 0.0001 suggests relatively low probability of exploitation within the next 30 days compared to the broader CVE population. Organizations using affected OpenHarness deployments should apply the patch at commit 166fcfe or later as a precautionary measure.