---
id: CVE-2026-92750
title: >-
  Harness through 3.3.0 omits access control validation in the infrastructure
  provider read endpoint, allowing authenticated users to retrieve provider
  configurations from spaces they do not belong to
summary: >-
  Harness through 3.3.0 omits access control validation in the infrastructure
  provider read endpoint, allowing authenticated users to retrieve provider
  configurations from spaces they do not belong to. Attackers can query the GET
  /api/v1/i…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
vendor: harness
product: harness
affected:
  - harness <= 3.3.0
published: '2026-09-16'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:04:40.340'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92750'
references:
  - url: 'https://github.com/harness/harness'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/find.go#L25-L41
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/harness/harness/blob/v3.3.0/app/api/controller/infraprovider/list.go#L37
    label: disclosure@vulncheck.com
  - url: 'https://github.com/harness/harness/issues/3697'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/harness-through-3.3.0-missing-access-control-via-infraproviders-endpoint
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00276
epssPercentile: 0.178
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T19:16:48.895933Z'
ingestedAt: '2026-09-16T21:05:36.898Z'
---

## Overview

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configurations from spaces they do not belong to. Attackers can query the GET /api/v1/infraproviders endpoint with arbitrary space identifiers to expose sensitive provider metadata including Docker endpoints, TLS certificate paths, and cloud project identifiers.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.