Cyber Resilience

CVE-2026-22682

Access Control

Public PoCAccess Control
Published
07 April 2026
Modified
14 July 2026
CVSS Score v4 8.4
Click a component to see what it means
Raw vectorCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0013 3th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-22682 is a high-severity Incorrect Authorization (CWE-863) vulnerability. Its CVSS base score is 8.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-22682 is an improper access control vulnerability (CWE-863) affecting OpenHarness prior to commit 166fcfe. The issue resides in the built-in file tools, including read_file, write_file, edit_file, and notebook_edit, where inconsistent parameter handling fails to pass the path parameter to the PermissionChecker during permission enforcement. This allows attackers who can influence agent tool execution to read arbitrary local files outside the intended repository scope, bypassing deny rules.

Attackers require local access (AV:L) with low privileges (PR:L) and can exploit the vulnerability with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation grants high confidentiality (C:H) and integrity (I:H) impacts with no availability impact (A:N), enabling reading of sensitive files such as configuration files, credentials, and SSH material, or creating and overwriting files in restricted host paths when operating in full_auto mode.

Mitigation involves updating to OpenHarness commit 166fcfe or later, as detailed in the fixing commit at https://github.com/HKUDS/OpenHarness/commit/166fcfefb7614dbac51bd061f56542725b0298e9 and associated pull request at https://github.com/HKUDS/OpenHarness/pull/32. Additional guidance is available in the VulnCheck advisory at https://www.vulncheck.com/advisories/openharness-improper-access-control-via-file-tools.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

OpenHarness prior to commit 166fcfe contains an improper access control vulnerability in built-in file tools due to inconsistent parameter handling in permission enforcement, allowing attackers who can influence agent tool execution to read arbitrary local files outside the intended repository…

more

scope. Attackers can exploit the path parameter not being passed to the PermissionChecker in read_file, write_file, edit_file, and notebook_edit tools to bypass deny rules and access sensitive files such as configuration files, credentials, and SSH material, or create and overwrite files in restricted host paths in full_auto mode.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1005 Data from Local System Collection
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
Why these techniques?

Improper access control in file tools directly enables unauthorized reads of arbitrary local files, including credentials and private keys (SSH material).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-26336Shared CWE-863
CVE-2026-29196Shared CWE-863
CVE-2026-65054Shared CWE-863
CVE-2026-42883Shared CWE-863
CVE-2026-33469Shared CWE-863
CVE-2026-28724Shared CWE-863
CVE-2026-56152Shared CWE-863
CVE-2026-41350Shared CWE-863
CVE-2025-68152Shared CWE-863
CVE-2026-10741Shared CWE-863

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-25 Reference Monitor
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mandates enforcement of approved access authorizations for system resources like local files, addressing the failure to pass path parameters to the PermissionChecker in file tools.

prevent

Requires a tamper-resistant reference monitor to mediate all access subject/object interactions, ensuring consistent permission checks for arbitrary file paths in agent tools.

prevent

Enforces least privilege for processes influencing agent tool execution, limiting the scope of unauthorized file reads and writes despite the access control bypass.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

prevents

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

prevents

By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.

References