CVE-2026-15036: Harness Gitspaces Authorization Bypass (CVSS 4.3)

Technical summary

CVE-2026-15036 is an authorization bypass flaw in the gitspaces list_all.go controller affecting the getAuthorizedSpaces function in Harness up to version 2.28.2. The vulnerability stems from improper access control logic (CWE-285, CWE-639) that fails to validate user permissions correctly when retrieving workspace information. An authenticated attacker can craft requests that bypass authorization checks and retrieve confidential space metadata. The CVSS 3.1 score of 4.3 reflects limited impact—confidentiality is compromised but integrity and availability are unaffected—in an environment where the attacker must already possess valid credentials.

Business impact

This vulnerability allows insider threats and compromised account holders to conduct reconnaissance of your Harness infrastructure. An attacker gaining a single developer or CI/CD user account could enumerate all gitspaces across your organization, revealing project structure, team names, and deployment configurations. While the direct blast radius is information disclosure, this reconnaissance capability can facilitate lateral movement, supply chain targeting, or social engineering. Organizations relying on workspace isolation for multi-tenant or role-based security postures face degraded assurance.

Affected systems

All Harness deployments running version 2.28.2 or earlier are affected. The gitspaces feature must be enabled or in use for exposure. Self-hosted and SaaS Harness instances are both susceptible. No vendor or product list is available in the source data; verify your specific Harness deployment version against the vendor advisory.

Exploitability

Exploitability is moderate. The attack requires valid Harness credentials (authentication), meaning external attackers cannot exploit this directly—it requires insider access, compromised accounts, or supply chain infiltration. However, the flaw is straightforward to trigger once authenticated: a simple API manipulation during normal gitspace enumeration requests bypasses authorization. Public disclosure of the vulnerability further lowers the barrier; an attacker with credentials needs minimal technical sophistication. The lack of vendor response to early notification suggests a patch may be delayed.

Remediation

Upgrade Harness to a version beyond 2.28.2 once a patched release is confirmed by the vendor. If you cannot upgrade immediately, implement network-level access controls restricting gitspaces endpoints to trusted networks or VPNs. Review and enforce strict credential hygiene: rotate API tokens, enforce multi-factor authentication on user accounts, and monitor access logs for suspicious gitspace enumeration patterns. Consider disabling gitspaces entirely if not in active use.

Patch guidance

Monitor Harness release notes and security advisories for version 2.28.3 or later. Verify the advisory explicitly addresses CVE-2026-15036 and CWE-285 authorization bypass fixes before deploying. Test patches in a non-production environment first, as gitspaces changes may affect CI/CD workflows. Apply patches promptly given the public exploit availability.

Detection guidance

Monitor Harness API access logs for repeated calls to getAuthorizedSpaces or list_all endpoints from single users, especially outside business hours or from unusual network locations. Track enumeration of gitspace names or metadata by low-privileged accounts. Alert on any authorization exceptions or permission-denied errors that fail to block subsequent successful API calls. If you have SIEM integration, correlate Harness API access with failed authentication attempts immediately preceding successful gitspace queries.

Why prioritize this

This vulnerability ranks MEDIUM priority but warrants faster remediation than the score alone suggests. The public exploit availability and vendor non-response create urgency. While the CVSS score is modest due to authentication requirement, the attack surface includes all users with Harness access. In zero-trust or high-security environments, any authorization bypass—even read-only—represents a control failure requiring rapid patching.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects: (1) network accessibility (AV:N), (2) low attack complexity requiring only standard API calls (AC:L), (3) authentication required (PR:L), (4) no user interaction (UI:N), (5) limited scope (S:U), and (6) confidentiality impact only (C:L, I:N, A:N). The score does not escalate despite public disclosure because exploitability assumes a valid attacker account, which is outside CVSS's threat model. In your organization's context, elevation may be warranted if your user base is large or insider-threat risk is elevated.

Frequently asked questions