CVE-2026-49405 in OpenHuman
Summary
by MITRE • 11/05/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in OpenHuman versions prior to 0.56.0 represents a critical failure in access control and data isolation within an open-source agent harness that functions as both a desktop application and a Rust library. The core of the issue lies in the configuration of its local server, specifically regarding the handling of Server-Sent Events (SSE) at the /events endpoint. This endpoint was designed to stream real-time updates from a process-wide event bus to connected clients, facilitating communication between the user interface and the underlying agent logic. However, the implementation lacked essential security controls, allowing any entity capable of reaching this local service to interact with it without restriction.
From an authentication perspective, the server exposed the /events endpoint without requiring bearer token authentication or any other form of identity verification. This absence of mandatory access control means that there is no mechanism to distinguish between legitimate application components and unauthorized external requests. Furthermore, Cross-Origin Resource Sharing (CORS) policies were configured to permit cross-origin browser access. While CORS restrictions are often relaxed for local development environments to facilitate debugging, in this context, it created a severe attack vector where malicious web pages hosted on remote servers could initiate requests against the localhost service of an unsuspecting user.
The technical flaw extends beyond simple authentication bypass into the realm of identifier predictability and lack of isolation. The system relied solely on a caller-supplied client_id to filter WebChannelEvent objects from the global event bus. In versions prior to 0.56.0, this client identifier was either fixed or easily guessable due to predictable generation patterns. Consequently, an attacker does not need to discover unique session tokens or complex identifiers; they can simply subscribe to a known stream by supplying the expected client_id. This design flaw effectively nullifies any attempt at multi-tenant isolation within the local process, as all events are broadcasted in a manner that allows any subscriber with the correct identifier to intercept them.
The operational impact of this vulnerability is significant due to the sensitivity of the data transmitted through these streams. An unauthenticated local client or an attacker-hosted web page can subscribe to another user's stream and receive complete assistant responses, streamed message content, tool names, arguments passed to those tools, and raw tool outputs. This exposure reveals detailed insights into how the AI agent is operating, including its reasoning processes, external API calls, and data processing steps. For users employing OpenHuman for sensitive tasks or handling proprietary information, this constitutes a severe confidentiality breach, as all interactions are effectively public within the local network context accessible to any running browser tab or application.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to verify identity before granting access to resources. Additionally, it relates closely to CWE-201, Exposure of Sensitive Information Through an Error Message or Unprotected Channel, as well as CWE-359, Exposure of Private Personal Information to an Unauthorized Actor. In terms of adversary tactics, this scenario maps to the ATT&CK technique T1567.002, Exfiltration Over Web Service, where data is stolen via HTTP/S requests initiated by a malicious webpage or script running in the victim's browser environment leveraging local service vulnerabilities.
Mitigation for this issue was implemented in version 0.56.0 of OpenHuman. Users are strongly advised to upgrade immediately to ensure that proper authentication mechanisms are enforced on the /events endpoint and that CORS policies are tightened to prevent unauthorized cross-origin access. Until an update is applied, users should avoid running untrusted web pages while the application is active or restrict network access to localhost services through firewall rules if possible. The primary remediation strategy remains updating to a patched version where these security controls have been rigorously tested and implemented to ensure that only authenticated and authorized clients can subscribe to event streams.