Medium severity6.5NVD Advisory· Published Sep 16, 2026
CVE-2026-92750
CVE-2026-92750
Description
Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/find.gonvd
- github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/list.gonvd
- github.com/harness/harness/issues/3697nvd
- www.vulncheck.com/advisories/harness-through-3.3.0-missing-access-control-via-infraproviders-endpointnvd
News mentions
0No linked articles in our index yet.