{"id":"CVE-2026-125331","published":"2026-11-10T19:21:10.630","lastModified":"2026-11-10T19:21:10.630","description":"HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-862","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00","tags":[]},{"url":"https://github.com/HarnessRouter/harnessrouter/pull/418","tags":[]},{"url":"https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8","tags":[]},{"url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv","tags":[]}],"exploitRefs":[{"url":"https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00","tags":[]},{"url":"https://github.com/HarnessRouter/harnessrouter/pull/418","tags":[]},{"url":"https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8","tags":[]},{"url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv","tags":[]}],"hasPoc":true,"ai":{"summary":"In HarnessRouter versions prior to 0.31.8, non-self-hosted deployments incorrectly attach the server's internal authorization key to requests before validating the provided bearer token, and certain API routes trust this key to derive organization context from the URL. This allows unauthenticated attackers to forge requests that impersonate any organization and modify provider connections, leading to credential theft and injection of malicious responses into agent workflows.","exploitability":"Exploitation is straightforward for remote attackers with network access, requiring only knowledge of the vulnerable endpoints and ability to craft malformed Authorization headers; no prior authentication or privileged access is needed.","blast_radius":"Successful exploitation enables cross-tenant data exfiltration and command injection into agent tasks across organizations in multi-tenant deployments, potentially compromising all tenants sharing the same instance.","remediation":"Upgrade to HarnessRouter version 0.31.8 immediately to patch the authentication bypass and authorization flaw.","detection":"Defenders should monitor for anomalous PUT/GET requests to /v1/orgs/{org}/connections/{name}, /v1/orgs/{org}/policy/{backend}, or /internal/* paths where the Authorization header contains a non-standard or malformed bearer token, especially when paired with suspicious organization IDs not matching known internal usage patterns.","tags":["auth-bypass","privilege-escalation","multi-tenant","api-abuse","credential-theft"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:58:36.274Z"}}