CVE-2026-49393

OpenHuman’s socket transport exposes privileged agent controls

Tiny Humans · OpenHuman core RPC

First documented disclosure · Review checkpoint

Summary

The socket transport can expose privileged agent controls without its HTTP authentication requirement.

Severity and exploitation evidence

High · 8.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

HTTP and socket transports applied different authentication rules to the same core control operations.

Conditions required

A client must be able to reach the local socket service.

Potential impact

A client can invoke protected controls, potentially accessing connected accounts or altering local data and services.

Affected versions and configurations

Before 0.56.0.

Fix and mitigation status

0.56.0.

Practical next steps

Update to 0.56.0 and verify authentication on each enabled transport.

Operating lesson

Apply a shared authorization decision across every transport for a privileged operation.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources