# CVE-2026-92750: Harness through 3.3.0 Missing Access Control via infraproviders endpoint

> CVE-2026-92750: Harness through 3.3.0 Missing Access Control via infraproviders endpoint. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-92750
Last updated: 2026-09-24T21:04:40Z

- Published: 2026-09-16 20:32 UTC · Updated: 2026-09-24 21:04 UTC · Assigner: VulnCheck
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS: 0.28%, 20th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-862

## Description

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.

## Affected vendors and products

- harness: harness

## Tracked companies

- [Harness](https://rewindex.com/company/harness.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-92750)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-92750)
- [https://github.com/harness/harness](https://github.com/harness/harness)
- [https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/find.go\#L25-L41](https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/find.go#L25-L41)
- [https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/list.go\#L37](https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/list.go#L37)
- [https://github.com/harness/harness/issues/3697](https://github.com/harness/harness/issues/3697)
- [https://www.vulncheck.com/advisories/harness-through-3.3.0-missing-access-control-via-infraproviders-endpoint](https://www.vulncheck.com/advisories/harness-through-3.3.0-missing-access-control-via-infraproviders-endpoint)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-92750 · Markdown: https://rewindex.com/cve/CVE-2026-92750.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-92750 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:12:11.451Z