The vulnerability in HKUDS OpenHarness before commit bd4df81 is due to incorrect authorization (CWE-863) caused by incomplete path normalization in the permission checking mechanism. This flaw permits attackers to bypass path-based access controls by invoking built-in grep and glob tools with sensitive root directories that are not properly evaluated against configured path rules. As a result, attackers can read sensitive local files, key material, configuration files, or directory contents despite restrictions intended to prevent such access. The CVSS 4.0 score is 8.7 (high), indicating a network exploitable vulnerability with no required privileges or user interaction and high impact on confidentiality.

Successful exploitation allows an unauthenticated attacker to bypass permission checks and read sensitive files on the affected system. This can lead to disclosure of confidential information such as cryptographic keys, configuration files, and other sensitive local data. The vulnerability compromises confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in commit bd4df81, users should update OpenHarness to versions including or after this commit once available. Until then, restrict access to the affected system and monitor for any unusual file access attempts related to grep and glob usage.