CVE-2026-54146

OpenHuman’s desktop environment can expose its local RPC credential

Tiny Humans · OpenHuman macOS desktop

First documented disclosure · Review checkpoint

Summary

The desktop process environment exposes the core authorization token to other same-account processes.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The macOS desktop process placed the core credential in an environment visible to other same-user processes.

Conditions required

A local process must run under the same macOS user account.

Potential impact

A local process can recover the bearer credential and call privileged core operations.

Affected versions and configurations

0.53.15 to before 0.57.5 on macOS.

Fix and mitigation status

0.57.5.

Practical next steps

Update to 0.57.5 and restart the desktop session to replace the per-launch credential.

Operating lesson

Pass local credentials through a private process channel.

Evidence and limits

The dated public project record and the later CVE describe the same affected component. The fixed version is identified by the project or assigning authority.

Sources