Raw vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-22682 is a high-severity Incorrect Authorization (CWE-863) vulnerability. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22682 is an improper access control vulnerability (CWE-863) affecting OpenHarness prior to commit 166fcfe. The issue resides in the built-in file tools, including read_file, write_file, edit_file, and notebook_edit, where inconsistent parameter handling fails to pass the path parameter to the PermissionChecker during permission enforcement. This allows attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope, bypassing deny rules.
Attackers require local access (AV:L) with low privileges (PR:L) and can exploit the vulnerability with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high confidentiality (C:H) and integrity (I:H) impacts with no availability impact (A:N), enabling reading of sensitive files such as configuration files, credentials, and SSH material, or creating and overwriting files in restricted host paths when operating in full_auto mode.
Mitigation involves updating to OpenHarness commit 166fcfe or later, as detailed in the fixing commit at https://github.com/HKUDS/OpenHarness/commit/166fcfefb7614dbac51bd061f56542725b0298e9 and associated pull request at https://github.com/HKUDS/OpenHarness/pull/32. Additional guidance is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/openharness-improper-access-control-via-file-tools.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19746
Vulnerability Data
OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository…
more
scope. Attackers can exploit the path parameter not being passed to the PermissionChecker in read_file, write_file, edit_file, and notebook_edit tools to bypass deny rules and access sensitive files such as configuration files, credentials, and SSH material, or create and overwrite files in restricted host paths in full_auto mode.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper access control in file tools directly enables unauthorized reads of arbitrary local files, including credentials and private keys (SSH material).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates enforcement of approved access authorizations for system resources like local files, addressing the failure to pass path parameters to the PermissionChecker in file tools.
Requires a tamper-resistant reference monitor to mediate all access subject/object interactions, ensuring consistent permission checks for arbitrary file paths in agent tools.
Enforces least privilege for processes influencing agent tool execution, limiting the scope of unauthorized file reads and writes despite the access control bypass.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.
Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.
By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.