ETK-2026-3590Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3590",
  "cve_id": null,
  "display_id": "ETK-2026-3590",
  "ghsa_id": "GHSA-9vjr-jffm-mxc7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Git import file disclosure and SSRF in harnessrouter",
  "summary": "The harnessrouter Docker image's environment Git-import feature is affected before version 0.32.1. A user authorized to create an environment may obtain files readable by the runner or cause the runner to connect to services reachable from its network context.",
  "mitigation": "Upgrade the harnessrouter Docker image to version 0.32.1 or later. Until upgraded, restrict environment creation and disable or tightly control Git-based environment imports.",
  "vendor": "other",
  "product": "other:harnessrouter/harnessrouter (Docker image)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.32.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "0.32.1"
      ],
      "package_name": "harnessrouter/harnessrouter (Docker image)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 16.309444816666666,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-05T06:10:16.040049+00:00",
      "days": -0.6912668115046297,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T22:45:41.554574+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T00:52:14+00:00",
      "days": -1.9121237565162037,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T22:45:41.554574+00:00",
      "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9vjr-jffm-mxc7"
    }
  }
}