CVE-2026-82033

Unauthenticated Harness RPC can run tools with another user’s authority

DeepSeek · DeepSeek Harness web profile

First documented disclosure · Review checkpoint

Summary

A second local process can reach the web control plane, submit prompts and operate the original user’s agent.

Severity and exploitation evidence

High · 8.6/10 · CVSS 4.0. Severity source.

Exploitation not established: The CNA and upstream code describe the exposure. Malicious use or victim compromise was not documented in the reviewed evidence.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

HTTP and WebSocket session methods accepted calls without authenticating the caller. The event stream shared session and approval identifiers that the response endpoint accepted as evidence of approval.

Conditions required

The victim runs a vulnerable tool-capable web profile. The attacker can reach the listener, including from another OS account on the same host. Wider network exposure depends on binding or forwarding.

Potential impact

Commands and file operations can run as the victim, model usage can be charged to their credentials, and another process can observe live session events or answer tool-approval requests.

Affected versions and configurations

VulnCheck lists versions before 0.1.2-alpha.2. The exact commit boundary conflicts with the upstream patch.

Fix and mitigation status

VulnCheck identifies 0.1.2-alpha.2 as the fixed release. That tag contains the browser Host API authentication change.

Practical next steps

Update the web profile to a release containing the authenticated control plane. On shared hosts, verify that another local account cannot create sessions, read events or submit approval responses.

Operating lesson

Bind tool approvals and event subscriptions to an authenticated session. A loopback connection alone does not identify the user.

Evidence and limits

VulnCheck lists August 25 as public disclosure and publishes the CVE November 4. It labels 3e24087 both an affected revision and the patch. The upstream diff implements browser authentication there, and the August 30 release contains it. The exact last vulnerable commit is unresolved.

Sources