ETK-2026-3590

validated

GHSA-9vjr-jffm-mxc7 ↗

check availablenot proven exploitable

awaiting cvepublic pockev

other:harnessrouter/harnessrouter (Docker image) < 0.32.1

fixed in 0.32.1

ETK-2026-3590, no cve assigned

cvss7.0ethiack provisional

−16h41mTTV

16mAI analysis

Check if you are vulnerable

timeline

0 = cve.org, not yet published

trigger signal −1.9dcheck available−0.7dagent stopped

−1d

description

The harnessrouter Docker image's environment Git-import feature is affected before version 0.32.1. A user authorized to create an environment may obtain files readable by the runner or cause the runner to connect to services reachable from its network context.

mitigation

Upgrade the harnessrouter Docker image to version 0.32.1 or later. Until upgraded, restrict environment creation and disable or tightly control Git-based environment imports.

fixed in 0.32.1

check

available

exploit

automation

deterministic

auth required

–

EPSS

–

agent run time

16m

cve.org record, t = 0

not published yet

Δ to public poc

–

Δ to kev

–

outcome

Check only, differential: the check fires on the vulnerable build and is silent on the patched one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-04 00:52Z
ghsa: trigger signal, started the run
https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9vjr-jffm-mxc7

this entry in the feed

GET /api/v1/feed/ETK-2026-3590

{
  "etk_id": "ETK-2026-3590",
  "cve_id": null,
  "display_id": "ETK-2026-3590",
  "ghsa_id": "GHSA-9vjr-jffm-mxc7",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Git import file disclosure and SSRF in harnessrouter",
  "summary": "The harnessrouter Docker image's environment Git-import feature is affected before version 0.32.1. A user authorized to create an environment may obtain files readable by the runner or cause the runner to connect to services reachable from its network context.",
  "mitigation": "Upgrade the harnessrouter Docker image to version 0.32.1 or later. Until upgraded, restrict environment creation and disable or tightly control Git-based environment imports.",
  "vendor": "other",
  "product": "other:harnessrouter/harnessrouter (Docker image)",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 0.32.1"
      ],
      "ecosystem": "other",
      "fixed_versions": [
        "0.32.1"
      ],
      "package_name": "harnessrouter/harnessrouter (Docker image)",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 16.309444816666666,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-11-05T06:10:16.040049+00:00",
      "days": -0.6949935445949074,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T22:51:03.738763+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T00:52:14+00:00",
      "days": -1.9158504896064814,
      "is_lower_bound": true,
      "measured_at": "2026-11-05T22:51:03.738763+00:00",
      "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9vjr-jffm-mxc7"
    }
  }
}

published 2026-11-05 05:53Z
last change 2026-11-05 22:47Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.