Açıklama
In HarnessRouter Community Edition from 0.4.2 until 0.31.7, routes that take a session or response id checked only the caller's organization and not the workspace an API key was made in, while the session list was filtered by that workspace (CWE-639). A key of a non-default workspace that learned the id of another workspace's session in the same organization could read its metadata, turns, trace and files, overwrite files, cancel or delete it, and publish a share link for it. Organization boundaries held. Fixed in 0.31.7 (PR #417).
CVSS Vektörü
Birincil değerlendirmeGitHub CNA · 7.5 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HAV: Ağ (Network)AC: Yüksek (High)PR: Düşük (Low)UI: Yok (None)S: Değişmez (Unchanged)C: Yüksek (High)I: Yüksek (High)A: Yüksek (High)
Bildirim Durumu
- Etkilenen sürümler
- harnessrouter >= 0.4.2, < 0.31.7
- Yama durumu
- Fixed in 0.31.7
- Üretici yanıtı
- Maintainers merged PR #417, released 0.31.7 and published GHSA-9pjr-97x3-c4wv
- Birincil puan kaynağı
- GitHub CNA
Referanslar
- CVE.org Kaydı
- GitHub Security Advisory GHSA-9pjr-97x3-c4wv
- Fix: a workspace's API key reaches that workspace only (PR #417)
- Fix commit 249c6cc
- HarnessRouter 0.31.7 release
- NVD — Ulusal Zafiyet Veritabanı
- MITRE CVE Girişi
Kayıt Doğrulama
KrediGitHub advisory GHSA-9pjr-97x3-c4wv, bildiren olarak Sevban DÖNMEZ (jankesec) adını belirtir
YayınlanmaCVE kaydı 2026-11-10 tarihinde yayınlandı
KontrolMetaveriler son olarak 2026-11-10 tarihinde CVE Services kaydıyla doğrulandı
Bildirim Zaman Çizelgesi
2026-09-08Reported — Reported privately through GitHub private vulnerability reporting, with a reproducing test, as GHSA-9pjr-97x3-c4wv.
2026-10-06Fix released — PR #417 merged and HarnessRouter 0.31.7 released; GHSA-9pjr-97x3-c4wv published the same day. Kaynak ↗
2026-11-10Published — GitHub, as CNA, published the CVE record. Kaynak ↗
2026-11-10Site verification — jankesec re-ran the reproduction against 0.31.6 and 0.31.7 and checked the CVE record, score, affected versions and references.