OpenHarness versions before commit 166fcfe contain a CWE-863 improper authorization vulnerability due to inconsistent handling of the path parameter in permission enforcement for built-in file tools. Specifically, the path parameter is not passed to the PermissionChecker in several tools (read_file, write_file, edit_file, notebook_edit), allowing attackers with limited privileges who can influence agent tool execution to bypass access controls. This enables reading arbitrary local files outside the repository scope and creating or overwriting files in restricted host paths when operating in full_auto mode. The vulnerability has a CVSS 4.0 score of 8.4 (high severity), indicating significant impact potential. No patch or vendor advisory confirming remediation is currently available.

Successful exploitation allows attackers with limited privileges to bypass intended access controls and read sensitive local files such as configuration files, credentials, and SSH keys. Additionally, attackers can create or overwrite files in restricted host paths under certain modes, potentially leading to unauthorized data disclosure or modification. This compromises confidentiality and integrity of the affected system's local files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to agent tool execution to trusted users only and monitor for unauthorized use of the affected file tools. Avoid running OpenHarness in full_auto mode if possible, as it increases risk of file creation or overwriting. Follow vendor updates closely for an official patch or mitigation instructions.