Live › vulnerability › CVE-2026-114361
Go to dashboardHarnessRouter up to 0.31.10 trusts the X-Harness-Org and X-Harness-Member request headers in its Identity Mode gateway without proper checks. A remote attacker can manipulate these headers to get improper authorization.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running HarnessRouter 0.31.10 or earlier with Identity Mode enabled, where the gateway accepts the X-Harness-Org and X-Harness-Member headers from clients. Deployments that do not use Identity Mode are likely not exposed, though the sources do not confirm this.
No product ranges from the sources yet.
0.31.11 (patch 48a26cdf9c4544d2c88d1a07f0777f063f1d753f)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
This page as .md · .json · in your agent: get_signal("CVE-2026-114361")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.