CVE-2026-116368 in Harness
Summary
by MITRE • 10/26/2026
A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability resides within the DeepSeek Harness software, specifically affecting versions up to 0.2.0-rc.2, and centers on a critical flaw in the Browser Auth component located at packages/client/connection/src/browser-auth.ts. This module is responsible for handling authentication logic when clients connect via web browsers, a common interface for modern web applications that rely on session management and token-based security models. The core technical issue involves an improper processing of input data or state during the authorization workflow, which leads to a failure in enforcing access controls correctly. Such flaws typically stem from insufficient validation of credentials, mishandling of authentication tokens, or logic errors that allow attackers to bypass standard verification steps. Because this component is integral to establishing secure sessions, any deviation in its processing can result in unauthorized entities gaining elevated privileges or accessing protected resources without valid authentication.
From a technical perspective, the flaw represents a classic case of improper authorization, which aligns with CWE-284 from the Common Weakness Enumeration standard. This category encompasses scenarios where an actor is able to access data for which they are not authorized or perform actions outside their defined permissions. In the context of browser-based authentication, this could manifest as session fixation attacks, token manipulation, or bypassing multi-factor authentication checks if such mechanisms were intended but improperly implemented in the affected code path. The vulnerability allows remote attackers to exploit these weaknesses without requiring prior access, making it a high-severity issue that can be leveraged from across network boundaries. This aligns with ATT&CK technique T1078, which covers valid accounts and authentication bypasses, indicating that an adversary could potentially use this flaw to establish persistent unauthorized access or escalate privileges within the application environment.
The operational impact of this vulnerability is significant due to its remote exploitability. Since the attack can be initiated remotely, threat actors do not need physical proximity or local system access to compromise the integrity of user sessions and data confidentiality. Successful exploitation could lead to full account takeover, exposure of sensitive personal information, or unauthorized modification of application state depending on what resources are protected by this authentication layer. The lack of response from the vendor since early contact raises concerns about timely remediation efforts, leaving users exposed for an extended period. Without a patch or official mitigation guidance, organizations relying on DeepSeek Harness must assume that all instances running vulnerable versions are potentially compromised and require immediate attention through alternative security controls such as web application firewalls to filter malicious authentication requests or strict input validation at the network perimeter.
To mitigate this risk in the absence of an official vendor update, administrators should implement compensating controls that enforce stricter access policies independent of the flawed component where possible. This includes deploying rate limiting on authentication endpoints to prevent brute-force exploitation of any remaining logic flaws and ensuring that all sensitive actions require additional verification layers not dependent solely on the browser auth module. Additionally, monitoring for anomalous login patterns or unusual session behaviors can help detect potential exploitation attempts in real-time. It is crucial to upgrade to a patched version as soon as it becomes available from DeepSeek, while simultaneously auditing logs for signs of unauthorized access that may have occurred during the window of vulnerability exposure.