CVE-2026-82033 in DeepSeek Harness
Summary
by MITRE • 11/04/2026
DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in DeepSeek Harness prior to version 0.1.2-alpha.2 represents a critical failure in access control mechanisms within its web profile HTTP and WebSocket RPC control plane. This flaw stems from an absence of authentication checks for specific remote procedure call endpoints, allowing any local process on the host system to interact with sensitive session management functions regardless of the operating user context. Specifically, commit 3e24087 introduced or failed to mitigate this issue, enabling unauthenticated access to methods such as session.create and session.prompt. This architectural oversight effectively treats all local connections as trusted, violating the principle of least privilege by granting broad capabilities to any process running on the same machine, including those executed under different user accounts with potentially lower privileges than the DeepSeek Harness service itself.
The operational impact of this vulnerability is severe due to the nature of the exposed methods and their integration with powerful agent tools. An attacker leveraging session.prompt can trigger the execution of bash commands and access filesystem resources configured within the agent's environment. This capability allows for arbitrary command execution as the victim user, who possesses the model credentials associated with the DeepSeek Harness instance. Consequently, an adversary can achieve full control over the host system by executing malicious scripts, exfiltrating data from accessible directories, or pivoting to other systems if network access is available through the compromised environment. The severity is further amplified because this execution occurs under the context of the user running the harness service, which often holds elevated permissions necessary for development and deployment tasks.
Beyond direct command execution, the vulnerability facilitates significant surveillance capabilities within the local ecosystem. Attackers can intercept live session traffic and logs transmitted over the event mux stream without authentication barriers. This exposure compromises confidentiality by revealing sensitive interaction data, model inputs, outputs, and potentially proprietary information processed during AI agent operations. Furthermore, the attacker can bypass human-in-the-loop approval mechanisms designed to prevent autonomous execution of dangerous actions. By matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream via POST /api/respond, an adversary can spoof legitimate requests that would normally require explicit user consent. This undermines safety guardrails intended to protect against unintended or malicious agent behavior, allowing automated exploitation without human intervention.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. The ability of any local process to invoke privileged functions constitutes an authorization bypass rooted in insufficient identity verification. In terms of offensive security tactics, this flaw supports ATT&CK techniques such as T1548 Abuse Elevation Control Mechanism if privilege escalation occurs via user context manipulation, and T1071 Application Layer Protocol for communication over HTTP/WebSocket channels. The interception of session traffic also relates to T1059 Command and Scripting Interpreter through the execution of arbitrary commands and potentially T1005 Data from Local System for exfiltration purposes.
Mitigation strategies must prioritize immediate patching to version 0.1.2-alpha.2 or later, where these authentication gaps are addressed by enforcing strict identity verification on all RPC endpoints. Until an update is applied, administrators should restrict network exposure of the web profile interface and implement host-based firewall rules to limit access to localhost only if external connectivity is not required. Additionally, running DeepSeek Harness under a dedicated service account with minimal permissions can reduce the blast radius in case of exploitation. Security monitoring should be enhanced to detect unusual patterns in RPC calls or unexpected command executions originating from local processes interacting with the harness API. Regular audits of configuration files and review of commit histories for similar authentication oversights are recommended to prevent recurrence across related components.