CVE-2026-114362 in HarnessRouter
Summary
by MITRE • 10/21/2026
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in HarnessRouter versions up to 0.31.12 represents a critical server-side request forgery flaw located within the Targets Test Endpoint functionality of the gateway application, specifically in the app.py module. This security defect arises from an insufficient validation mechanism applied to the base_url argument passed by users or external systems during endpoint testing operations. When this parameter is processed without rigorous sanitization or allow-listing checks, it allows attackers to inject malicious URLs that direct the server to make requests to unintended internal or external destinations. The core technical flaw lies in the application's failure to enforce strict constraints on the protocol, host, and port components of the provided URL, thereby bypassing standard security controls designed to prevent unauthorized network interactions initiated by the backend service itself.
From an operational perspective, this vulnerability enables remote attackers to leverage the server as a proxy or pivot point for further attacks against internal infrastructure that may not be directly accessible from the public internet. By crafting specific requests with manipulated base_url parameters, an attacker can force the vulnerable application to communicate with arbitrary endpoints. This capability facilitates data exfiltration from internal services, allows for port scanning of internal networks by observing response times or error messages, and potentially enables access to sensitive administrative interfaces running on localhost or private subnets. The impact is particularly severe in cloud-native environments where such flaws can lead to the compromise of container orchestration systems, secret management services, or other critical backend components that rely on the integrity of outbound requests from application servers.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-918, which classifies Server-Side Request Forgery (SSRF) as a distinct category of web server vulnerabilities where an attacker causes the server to make HTTP requests to arbitrary domains or ports. In terms of offensive security frameworks, this flaw maps directly to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle, and potentially T1046 Network Service Discovery if used for scanning purposes. The ability to manipulate the base_url effectively turns the application into a tool for lateral movement within a network architecture, bypassing perimeter defenses that typically protect against direct external access but do not monitor outbound traffic from trusted internal services.
To mitigate this risk and restore secure operations, it is imperative to upgrade HarnessRouter immediately to version 0.31.13 or later, which incorporates the necessary code corrections detailed in patch commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. This update addresses the underlying logic error by implementing robust input validation and URL parsing restrictions that prevent the interpretation of maliciously crafted base_url values as valid internal targets. In addition to upgrading, organizations should implement network-level controls such as egress filtering rules on firewalls or cloud security groups to restrict outbound connections from application servers to only known and necessary destinations. Furthermore, integrating Web Application Firewall signatures capable of detecting SSRF patterns can provide an additional layer of defense against exploitation attempts while the upgrade process is being completed across all affected instances.