CVE-2026-54145 in OpenHuman
Summary
by MITRE • 11/05/2026
OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in OpenHuman versions prior to 0.57.5 represents a critical flaw in credential management and session handling within an open-source agent harness that functions as both a desktop application and a Rust library. The core issue stems from the architectural decision to utilize the JSON-RPC bearer token itself as the identifier for approval sessions. This design choice fundamentally conflates authentication credentials with session state identifiers, leading to widespread exposure of sensitive security material during normal operational workflows. By embedding the actual secret token within records that are intended solely for tracking or debugging purposes, the application violates basic principles of secure credential storage and separation of concerns.
From a technical perspective, this misconfiguration results in the persistent leakage of authentication tokens across multiple system artifacts. Specifically, the bearer token is written to persisted approval records, event logs, debug log files, and RPC response payloads. These data structures are often stored on disk or transmitted over networks where they may be accessible to other processes, users with lower privileges, or potentially remote attackers if network traffic is intercepted. The exposure occurs not only during specific high-risk operations but also throughout the standard lifecycle of the desktop application, meaning that every interaction involving an approval gate contributes to the accumulation of exposed credentials in these log files and data stores.
The operational impact of this vulnerability is severe due to the nature of JSON-RPC bearer tokens as long-lived or session-bound secrets. An attacker who gains access to any of the affected artifacts can extract the valid token without needing to exploit additional vulnerabilities such as buffer overflows or injection flaws. Once obtained, this token grants immediate and unrestricted access to the core RPC interface associated with that session. This effectively bypasses authentication mechanisms entirely, allowing the adversary to perform privileged operations under the guise of a legitimate user agent. The scope of damage is further amplified because stable tokens remain valid until manually rotated by an administrator or system process, while launch-specific tokens persist for the entire duration of the core instance's activity, providing a wide window of opportunity for exploitation.
This vulnerability aligns with CWE-798: Use of Hard-coded Credentials and CWE-200: Exposure of Sensitive Information to an Unauthorized Actor within the Common Weakness Enumeration framework. The failure to properly isolate session identifiers from authentication secrets is also indicative of poor input validation and output encoding practices regarding sensitive data handling. In terms of offensive security tactics, this scenario maps directly to ATT&CK technique T1528: Steal Application Access Token, where adversaries seek to harvest tokens for lateral movement or privilege escalation within the application's ecosystem. The ability to recover these credentials from logs also touches upon T1074: Data Staged and potentially T1005: Data from Local System depending on how the artifacts are accessed by the attacker.
Mitigation strategies must prioritize immediate remediation through software updates, as a fixed version is already available in release 0.57.5 which addresses this architectural flaw. For environments where upgrading is not immediately feasible, administrators should implement strict log rotation policies with aggressive retention periods to minimize the window of exposure for any leaked tokens. Additionally, it is crucial to audit all persisted approval records and debug logs for traces of bearer tokens and revoke them if found. Future development efforts must enforce a clear separation between session identifiers and authentication credentials, ensuring that sensitive secrets are never written to persistent storage or transmitted in plaintext within response bodies unless absolutely necessary and properly encrypted.