CVE-2026-92750

CVE-2026-92750 is a missing access control (CWE-862) flaw in Harness, which through version 3.3.0 fails to validate authorization on the infrastructure provider read endpoint. Any authenticated user can send GET requests to /api/v1/infraproviders with arbitrary space identifiers belonging to spaces they are not a member of, and the server returns the provider configuration. This leaks sensitive provider metadata such as Docker endpoints, TLS certificate paths, and cloud project identifiers, which could aid further attacks against the underlying infrastructure. Any Harness deployment at version 3.3.0 or earlier with more than one user or space is affected. No public proof-of-concept, KEV listing, or confirmed exploitation has been reported.

What to do: Until a patched release beyond 3.3.0 is available, restrict which authenticated accounts can reach the Harness API, audit access logs for GET /api/v1/infraproviders calls referencing space identifiers outside the caller's membership, and apply network-level access controls to the API. Treat Docker endpoints, TLS certificate paths, and cloud project identifiers returned by this endpoint as potentially disclosed, and rotate or tighten related credentials and network exposure if compromise is suspected. Monitor vendor advisories for a fixed version and upgrade promptly once released.