CVE-2026-114361 in HarnessRouter
Summary
by MITRE • 10/22/2026
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability resides within the HarnessRouter software, specifically affecting versions up to 0.31.10 in the Identity Mode component. This security flaw is located in an unspecified function within the gateway/app.py file and stems from improper authorization logic when handling specific HTTP headers. The core technical issue involves a failure to correctly validate or enforce access control policies based on the X-Harness-Org and X-Harness-Member arguments provided by clients during API requests. When these header values are manipulated, the application fails to properly verify whether the requesting entity possesses the necessary permissions for the targeted resource or action. This represents a classic case of broken object level authorization where the system relies on client-supplied data without sufficient server-side validation against established access control lists or user roles.
From an operational perspective, this vulnerability allows for remote exploitation by unauthenticated attackers who can manipulate these headers to bypass intended security restrictions. The attack complexity is classified as high and exploitability as difficult, suggesting that while the flaw exists in a network-accessible service, successfully leveraging it requires significant effort, specialized knowledge of the internal architecture, or specific environmental conditions unique to the target deployment. Despite the difficulty of exploitation, the potential impact remains severe because improper authorization can lead to unauthorized access to sensitive data, privilege escalation, or complete compromise of the identity management infrastructure managed by HarnessRouter. Attackers could potentially impersonate other users or organizations within the platform, leading to data breaches and integrity violations across multiple tenant environments if multi-tenancy isolation is not strictly enforced elsewhere in the stack.
This vulnerability aligns with CWE-284 Improper Access Control and falls under MITRE ATT&CK technique T1078 Valid Accounts, as it involves bypassing authentication or authorization mechanisms to gain unauthorized access. The reliance on HTTP headers for identity assertion without robust validation is a common pattern in microservices architectures that can be exploited if not carefully implemented with centralized policy enforcement points. To mitigate this risk, organizations must immediately upgrade HarnessRouter to version 0.31.11 or later, which includes the patch identified by commit hash 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. This update addresses the underlying logic error in the gateway application that fails to properly restrict access based on the manipulated header values. In addition to upgrading, administrators should implement defense-in-depth strategies such as strict input validation for all incoming HTTP headers and ensure that critical authorization decisions are made server-side using trusted identity providers rather than relying solely on client-supplied metadata. Regular security audits of API gateways and continuous monitoring for anomalous access patterns can further reduce the risk associated with similar vulnerabilities in distributed systems.