Executive brief
OpenHarness, an AI agent framework, contains a security flaw that allows the AI to access sensitive files on the host machine that should be restricted. By providing specific instructions to the AI, an attacker can trick the system into using built-in search tools to read private data like SSH keys, configuration files, or system directories. This could lead to the theft of sensitive credentials or intellectual property from the environment where the software is running.
Technical details
A permission bypass vulnerability exists in OpenHarness due to incorrect authorization (CWE-863) and incomplete path normalization in the permission checker. The engine's query handler normalized 'file_path' and 'path' arguments but failed to normalize the 'root' argument used by the built-in grep and glob tools. An attacker can provide malicious prompt input that triggers these tools with a sensitive directory root (e.g., /home/user/.ssh), bypassing configured path rules and deny-globs. This allows for the disclosure of sensitive local file content and directory structures. The issue was addressed in commit bd4df81 by hardening path rules and ensuring the 'root' argument is properly normalized before permission evaluation.
Affected products
- HKUDS OpenHarness before commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
Timeline
- 2026-04-11: patched: Fix merged in commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
- 2026-04-17: advisory: NVD and VulnCheck advisory published