Live › vulnerability › CVE-2026-114362
Go to dashboardHarnessRouter up to 0.31.12 has a server-side request forgery flaw in the Targets Test Endpoint of gateway/app.py, where the base_url argument is not validated. A remote attacker can make the server send requests to hosts of their choosing, such as internal services.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running HarnessRouter up to 0.31.12 as an LLM gateway, especially where the test endpoint for targets can be reached by remote callers. Deployments that keep the endpoint on a private network with access limited to trusted users are less exposed. The sources do not say which configurations are most at risk.
No product ranges from the sources yet.
0.31.12 or earlier.0.31.13 (patch commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-114362")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.