CVE-2026-92750: Harness Auth Bypass Vulnerability

CVE-2026-92750 Overview

CVE-2026-92750 is a broken access control vulnerability in Harness through version 3.3.0. The flaw resides in the infrastructure provider read endpoint, which omits authorization validation before returning provider configurations. Authenticated users can query GET /api/v1/infraproviders with arbitrary space identifiers and retrieve provider metadata from spaces they do not belong to. Exposed data includes Docker endpoints, TLS certificate paths, and cloud project identifiers. The vulnerability is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated Harness user can enumerate infrastructure provider configurations across tenant boundaries, exposing Docker endpoints, TLS material paths, and cloud project identifiers useful for follow-on attacks.

Affected Products

Harness versions up to and including 3.3.0
app/api/controller/infraprovider/find.go handler
app/api/controller/infraprovider/list.go handler

Discovery Timeline

2026-09-16 - CVE-2026-92750 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92750

Vulnerability Analysis

The vulnerability affects Harness, an open-source continuous integration and delivery platform. The infrastructure provider read endpoint returns configuration objects without verifying that the requesting user has permission to access the target space. As a result, an authenticated low-privilege user can address any space identifier in the request and receive the corresponding provider configuration.

Exposed fields include Docker daemon endpoints, filesystem paths to TLS certificates, and cloud project identifiers. This metadata enables reconnaissance of build infrastructure, identification of internal endpoints, and mapping of tenant boundaries that should remain isolated.

Root Cause

The handlers in find.go and list.go accept a space identifier from the request and proceed to fetch provider records without invoking an authorization check against the caller's session. The authentication layer confirms the user is logged in, but no per-resource permission gate is applied before the read. This is a classic Missing Authorization pattern under CWE-862.

Attack Vector

Exploitation requires network reachability to the Harness API and any valid authenticated session. An attacker calls GET /api/v1/infraproviders while supplying a space identifier belonging to another tenant or team. The server returns the provider configuration objects for that space, including sensitive infrastructure metadata. No user interaction, elevated privileges, or exploitation tooling is required.

Technical details are documented in the VulnCheck Advisory for Harness and the corresponding GitHub Issue #3697. The vulnerable code paths are visible in the find function and the list function.

Detection Methods for CVE-2026-92750

Indicators of Compromise

Repeated GET /api/v1/infraproviders requests from a single authenticated principal against multiple distinct space identifiers.
API responses containing provider configurations for spaces where the caller has no assigned role.
Access log entries showing enumeration patterns across sequential or dictionary-derived space identifiers.

Detection Strategies

Correlate authenticated API activity against role assignments to flag reads of infraproviders outside the caller's authorized spaces.
Baseline normal per-user access to the infrastructure provider endpoint and alert on volume or breadth anomalies.
Inspect application logs for successful 200 responses from infraproviders handlers where the target space does not match the caller's membership set.

Monitoring Recommendations

Enable verbose audit logging on all /api/v1/infraproviders calls, capturing caller identity, target space, and response status.
Forward Harness API logs to a centralized log platform and build alerts on cross-tenant access patterns.
Review historical logs since the deployment of Harness 3.3.0 or earlier for evidence of prior exploitation.

How to Mitigate CVE-2026-92750

Immediate Actions Required

Upgrade Harness to a version later than 3.3.0 that includes the authorization fix once released by the vendor.
Restrict network exposure of the Harness API to trusted networks or through an authenticated reverse proxy that enforces additional access checks.
Rotate secrets, TLS certificates, and Docker endpoint credentials that may have been enumerated through the vulnerable endpoint.

Patch Information

Monitor the Harness GitHub repository and GitHub Issue #3697 for a patched release addressing the missing authorization check in find.go and list.go. Apply the fix as soon as it is available and validate that the infrastructure provider handlers enforce per-space authorization.

Workarounds

Reduce the pool of authenticated users to trusted operators until a patched release is deployed.
Place the Harness API behind a policy enforcement gateway that validates space membership on infraproviders requests.
Remove or rotate sensitive metadata stored in provider configurations, such as internal Docker endpoints and certificate paths, to limit exposure.

bash

# Example gateway rule to block cross-space infraproviders reads
# Deny requests where the space_id query parameter is not in the caller's allowed set
location /api/v1/infraproviders {
    access_by_lua_file /etc/nginx/lua/verify_space_membership.lua;
    proxy_pass http://harness_backend;
}