CVE-2026-54142

OpenHuman background sync can trigger unapproved connected-account actions

Tiny Humans · OpenHuman background sync

First documented disclosure · Review checkpoint

Summary

Content from connected services can induce unapproved agent actions.

Severity and exploitation evidence

High · 8.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The maintainer describes a research demonstration and CISA enrichment marks proof of concept. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Background agents trusted content synchronized from connected accounts and permitted actions without an interactive approval.

Conditions required

A connected service must supply content to background sync and the agent must have access to an actionable integration.

Potential impact

The agent can perform unauthorized operations against the user’s connected services.

Affected versions and configurations

Before 0.57.13.

Fix and mitigation status

0.57.13.

Practical next steps

Upgrade to 0.57.13 and review actions allowed during background synchronization.

Operating lesson

Carry source and human-approval requirements into asynchronous work.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources