{"id":"CVE-2026-114362","kind":"vulnerability","aliases":["CVE-2026-114362"],"related":[],"title":"HarnessRouter: test endpoint lets remote users force server-side requests","description":"A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.","summary":"HarnessRouter up to 0.31.12 has a server-side request forgery flaw in the Targets Test Endpoint of gateway/app.py, where the base_url argument is not validated. A remote attacker can make the server send requests to hosts of their choosing, such as internal services.","severity":"medium","cvss":6.5,"epss":0.00245,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","harnessrouter","llm-gateway","self-hosted"],"not_affected_if":["endpoint-not-reachable-remotely","version-0.31.13-or-later"],"how_to_check":"- Check the installed HarnessRouter version and confirm whether it is `0.31.12` or earlier.\n- Check whether the Targets Test Endpoint in gateway/app.py is reachable from outside the network.","fix":"- Upgrade HarnessRouter to `0.31.13` (patch commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28).","status":"open","published_at":"2026-10-21T20:17:25+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:48:54+00:00","updated_at":"2026-10-25T03:48:54+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:48:54Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade HarnessRouter to `0.31.13` (patch commit 1c4b1fc1f89737dabd089ac1d1c174a57f764e28).","reach":"internet","title":"HarnessRouter: test endpoint lets remote users force server-side requests","impact":"medium","summary":"HarnessRouter up to 0.31.12 has a server-side request forgery flaw in the Targets Test Endpoint of gateway/app.py, where the base_url argument is not validated. A remote attacker can make the server send requests to hosts of their choosing, such as internal services.","category":"ai-tooling","nicknames":[],"who_cares":["harnessrouter","self-hosted","llm-gateway"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server sends requests to internal hosts chosen by the attacker","analyst_note":"","how_to_check":"- Check the installed HarnessRouter version and confirm whether it is `0.31.12` or earlier.\n- Check whether the Targets Test Endpoint in gateway/app.py is reachable from outside the network.","needs_analyst":false,"not_affected_if":["version-0.31.13-or-later","endpoint-not-reachable-remotely"],"who_is_affected":"Teams running HarnessRouter up to 0.31.12 as an LLM gateway, especially where the test endpoint for targets can be reached by remote callers. Deployments that keep the endpoint on a private network with access limited to trusted users are less exposed. The sources do not say which configurations are most at risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3409,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114362':14A,17A '-2026':13A,16A '0.31.12':31B,82C '0.31.13':124C '1c4b1fc1f89737dabd089ac1d1c174a57f764e28':133C 'affect':140C 'ai':19B 'ai-tool':18B 'argument':51B,103C 'attack':57B,115C 'base':49B,104C 'call':132C 'choos':68B 'compon':94C,141C 'cve':12A,15A 'endpoint':3A,44B,97C 'execut':98C 'file':90C 'fix':126C 'flaw':39B,74C 'forc':7A 'forgeri':38B,113C 'found':77C 'function':87C 'gateway':24B 'gateway/app.py':46B,91C 'harnessrout':1A,21B,28B,79C 'host':27B,65B 'impact':84C 'intern':71B 'issu':128C 'lead':107C 'let':4A 'llm':23B 'llm-gateway':22B 'make':59B 'manipul':100C 'may':116C 'patch':130C 'perform':118C 'remot':5A,56B,120C 'request':11A,37B,63B,112C 'self':26B 'self-host':25B 'send':62B 'server':9A,35B,61B,110C 'server-sid':8A,34B,109C 'servic':72B 'side':10A,36B,111C 'suggest':136C 'target':42B,95C 'test':2A,43B,96C 'tool':20B 'unknown':86C 'upgrad':121C,138C 'url':50B,105C 'user':6A 'valid':54B 'version':123C","nicknames":[],"mitigations":[],"who_affected":"Teams running HarnessRouter up to 0.31.12 as an LLM gateway, especially where the test endpoint for targets can be reached by remote callers. Deployments that keep the endpoint on a private network with access limited to trusted users are less exposed. The sources do not say which configurations are most at risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T20:17:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114362","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114362","severity":null,"published_at":"2026-10-21T20:17:25+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114362","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114362","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}