Executive brief
Harness is a developer platform used to manage CI/CD pipelines, source control, and cloud infrastructure. A flaw in version 3.3.0 allows authenticated users to read sensitive infrastructure provider configurations—such as Docker endpoints and TLS certificate paths—from workspaces they should not have access to. An attacker with valid credentials can extract cloud and infrastructure details that could be used for further attacks or lateral movement.
Technical details
The vulnerability is an authorization bypass in the infrastructure provider read endpoint (GET /api/v1/infraproviders). The vulnerable code in find.go contains a commented-out ACL check for PermissionInfraProviderView, meaning no authorization validation is performed before returning provider configurations. An authenticated attacker can query the endpoint with arbitrary space identifiers to retrieve provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers from spaces they do not belong to. The fix requires uncommenting and implementing the authorization check to validate that the user has the necessary permissions for the requested space.
Affected products
- Harness Harness through 3.3.0
Timeline
- 2026-09-16: disclosed