https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T11:19:35.997712+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-92750 fkie_cve-2026-92750 2026-10-05T11:19:37.472107+00:00

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.

 https://vulnerability.circl.lu/vuln/ghsa-38q4-gjc8-cq8c GHSA-38q4-gjc8-cq8c 2026-10-05T11:19:37.472228+00:00

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.