CVE-2026-82533 in Harness
Summary
by MITRE • 09/08/2026
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual TCP connection origin. Attackers can exploit this flaw to invoke privileged commands such as commands/execute with danger-full-access permissions, escalate session approval policies to unconfined execution, and retrieve all stored conversations without any credential or API key.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in DeepSeek Harness prior to version 0.1.2-alpha.1 represents a critical authentication bypass flaw within its local HTTP control-plane API architecture. This security defect stems from an improper validation of the Host header, which serves as the primary mechanism for authenticating requests intended for privileged operations. In standard secure implementations, servers must verify that incoming requests originate from trusted sources by validating multiple factors such as TCP connection origins or using explicit authentication tokens. However, in this specific implementation, the server relies exclusively on the client-supplied Host header value to determine authorization levels rather than verifying the actual origin of the TCP connection. This architectural oversight creates a significant attack surface where an attacker can manipulate HTTP headers to impersonate trusted internal services or administrative interfaces that are typically restricted from external access.
From a technical perspective, this flaw aligns with CWE-287, which describes Improper Authentication, and specifically relates to CWE-346 regarding the Origin of a Vulnerable Component. The core issue lies in the server's failure to bind authentication decisions to the actual network socket or connection context. By accepting any value provided in the Host header without cross-referencing it against established trust boundaries or verifying the source IP address, the application effectively disables its access control mechanisms for local API endpoints. This allows an attacker who can send HTTP requests to the service, even from a non-privileged position on the same network segment or via certain proxy configurations, to bypass all intended security checks. The vulnerability is particularly severe because it affects the local control plane, which often assumes a higher level of trust than external-facing APIs but lacks robust perimeter defenses due to its internal nature.
The operational impact of this vulnerability is profound and potentially catastrophic for systems running affected versions of DeepSeek Harness. An attacker can exploit this flaw to gain full agent control without requiring any valid credentials or API keys. Specifically, the ability to invoke privileged commands such as commands/execute with danger-full-access permissions means that an adversary could execute arbitrary code on the host system where the harness is deployed. This level of access enables complete compromise of the underlying infrastructure, including the potential for data exfiltration, lateral movement within a network, or deployment of persistent backdoors. Furthermore, the capability to escalate session approval policies to unconfined execution removes any remaining safeguards that might limit the scope of actions an agent can perform, effectively granting unrestricted administrative control over the AI agent's behavior and capabilities.
In addition to command execution risks, the vulnerability allows for the retrieval of all stored conversations without authentication. This constitutes a severe data privacy breach under regulations such as GDPR or HIPAA if sensitive information is processed by these agents. The exposure of historical interaction logs can lead to intellectual property theft, leakage of proprietary business logic embedded in prompts and responses, and potential misuse of personal identifiable information contained within user interactions. Since the control plane manages the state and configuration of AI agents, compromising it also allows an attacker to modify agent behaviors, inject malicious instructions into future sessions, or disrupt service availability by altering operational parameters.
To mitigate this vulnerability, organizations must immediately upgrade DeepSeek Harness to version 0.1.2-alpha.1 or later where these authentication checks have been corrected. Until the update is applied, it is critical to restrict network access to the local HTTP control-plane API using firewall rules that only allow connections from trusted localhost addresses or specific internal subnets known to host legitimate administrative tools. Implementing mutual TLS (mTLS) for all communication with the control plane can also provide an additional layer of verification by ensuring both client and server identities are cryptographically validated, thereby neutralizing header spoofing attacks. Additionally, deploying web application firewalls that inspect and validate Host headers against a whitelist of expected values can help detect and block exploitation attempts in real-time while longer-term architectural fixes are implemented to ensure future versions bind authentication strictly to connection context rather than mutable HTTP headers.