ETK-2026-3569Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3569",
  "cve_id": null,
  "display_id": "ETK-2026-3569",
  "ghsa_id": "GHSA-cww9-m4gr-cmw5",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Provider credential exposure in HarnessRouter agent turns",
  "summary": "Self-hosted HarnessRouter versions before 0.37.15 may make provider credentials accessible to agent turns, including credentials associated with other usable connections. An attacker must be able to start or influence an agent turn, such as by supplying content the agent processes; local users may also be able to read credentials exposed through job command lines.",
  "mitigation": "Upgrade HarnessRouter to 0.37.15 or later. Rotate provider credentials after upgrading if untrusted users could run turns or agents processed untrusted content.",
  "vendor": "other",
  "product": "other:harnessrouter/harnessrouter",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.37.15"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "0.37.15"
      ],
      "package_name": "harnessrouter/harnessrouter",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.0566729,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-03T03:18:37+00:00",
      "days": -1.9769530101967594,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T02:45:25.826908+00:00",
      "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-cww9-m4gr-cmw5"
    }
  }
}