The vulnerability in HKUDS OpenHarness (CVE-2026-40515) arises from incomplete path normalization in the permission checking mechanism. This incorrect authorization (CWE-863) permits attackers to bypass intended path restrictions by exploiting how built-in grep and glob tools handle sensitive root directories. Consequently, unauthorized disclosure of sensitive files and directories can occur. The issue affects versions prior to commit bd4df81. The CVSS 4.0 base score is 8.7, indicating a high severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality.

Successful exploitation of this vulnerability allows an unauthenticated attacker to read sensitive files and directories that should be protected by path-based permission checks. This can lead to disclosure of sensitive local file content, cryptographic key material, configuration files, and directory contents. The integrity, availability, and other security properties are not impacted according to the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor HKUDS advisories for updates. Until a fix is available, consider restricting access to OpenHarness instances and sensitive files through external controls and minimize exposure to untrusted networks.