Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck

CVE-2026-92750Harness through 3.3.0 Missing Access Control via infraproviders endpoint

Medium 6.5

In plain English

A medium-severity missing authorization in harness from harness. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 79.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.

Affected products (as reported)

Vendor	Product	Versions
harness	harness	0 – through 3.3.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #3697 issue-tracking
https://github.com/harness/harness product
Find discards the session and has its ACL check commented out technical-description
sibling List calls apiauth.CheckInfraProvider technical-description
VulnCheck Advisory: Harness through 3.3.0 Missing Access Control via infraproviders endpoint third-party-advisory