{"id":"CVE-2026-116368","kind":"vulnerability","aliases":["CVE-2026-116368"],"related":[],"title":"DeepSeek Harness: browser auth flaw allows improper authorization remotely","description":"A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2. This issue affects some unknown processing of the file packages/client/connection/src/browser-auth.ts of the component Browser Auth. This manipulation causes improper authorization. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"DeepSeek Harness 0.2.0-rc.0 to 0.2.0-rc.2 has an improper-authorization flaw in its browser-session auth (browser-auth.ts). VulDB reports it is remotely exploitable without authentication, with no public exploit and no vendor response. A public maintainer-repo discussion (#8678) describes a likely related path. The cookie-signing secret sits in plaintext in $DSH_HOME/.credentials.yaml, where a sandboxed agent command can read it. The agent can then forge a valid session cookie, call the local control-plane API, switch itself to danger-full-access and skip approval prompts. That discussion does not cite this CVE.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DeepSeek Harness","fixed":[],"affected":">= 0.2.0-rc.0, <= 0.2.0-rc.2","ecosystem":"other"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","deepseek-harness","prompt-injection","sandbox-escape","self-hosted"],"not_affected_if":["loopback-only","no-untrusted-agent-input"],"how_to_check":"- Run the dsh/DeepSeek Harness version command and compare it with 0.2.0-rc.0, rc.1 and rc.2 (the versions VulDB lists as affected).\n- Check whether $DSH_HOME/.credentials.yaml exists and holds a browser-session secret; if so, a sandboxed command can read it.\n- Check whether dsh web is started with --host <non-loopback> or --trusted-host. The default bind is 127.0.0.1.","fix":"unknown: no fixed version or vendor advisory exists. VulDB found no countermeasure. Discussions mention master at 0.2.1-alpha.3, but nothing confirms a fix there. Settle it by checking the repo release notes or a commit touching browser-auth.ts. Until then, avoid running untrusted content through the agent, don't expose dsh web beyond loopback, and rotate the API key stored in .credentials.yaml if exposure is suspected.","status":"open","published_at":"2026-10-26T16:17:18+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","triaged_at":"2026-10-26T16:32:55+00:00","updated_at":"2026-10-26T16:33:27+00:00","category":"ai-tooling","confidence":0.55,"triage":{"at":"2026-10-26T16:32:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DeepSeek Harness: browser auth flaw allows improper authorization remotely","impact":"medium","summary":"DeepSeek Harness up to 0.2.0-rc.2 has a flaw in its browser authentication code (packages/client/connection/src/browser-auth.ts) that lets a remote attacker bypass authorization checks. The sources do not say what an attacker can reach after bypassing them.","category":"ai-tooling","nicknames":[],"who_cares":["deepseek-harness","ai-agents","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; remote attacker may bypass authorization checks","analyst_note":"Find the fixed version and vendor advisory; confirm what the bypassed authorization protects and whether default configs expose browser auth.","how_to_check":"- Check the installed DeepSeek Harness version against `0.2.0-rc.2`; versions up to and including it are listed as affected.\n- Look for `packages/client/connection/src/browser-auth.ts` in the project if you build from source.","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running DeepSeek Harness up to 0.2.0-rc.2 that expose its browser auth flow. The sources do not say whether managed or default setups are affected, and the vendor did not respond to disclosure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000595,"input_tokens":3335,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and vendor advisory; confirm what the bypassed authorization protects and whether default configs expose browser auth.","search":"'-116368':12A,15A '-2026':11A,14A '0.2.0':38B,41B,146C '8678':78B 'access':125B 'affect':150C 'agent':20B,98B,104B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':6A 'api':118B 'approv':128B 'attack':169C 'auth':4A,54B,162C 'authent':63B 'author':8A,47B,167C 'browser':3A,52B,161C 'browser-auth.ts':55B 'browser-sess':51B 'call':112B 'caus':165C 'cite':134B 'command':99B 'compon':160C 'contact':177C 'control':116B 'control-plan':115B 'cooki':86B,111B 'cookie-sign':85B 'cve':10A,13A,136B 'danger':123B 'danger-full-access':122B 'deepseek':1A,16A,25B,36B,142C 'deepseek-har':24B 'describ':79B 'determin':140C 'disclosur':181C 'discuss':77B,131B 'dsh':93B 'earli':178C 'escap':32B 'exploit':61B,67B 'file':156C 'flaw':5A,48B 'forg':107B 'full':124B 'har':2A,26B,37B,143C 'harness':17A 'home/.credentials.yaml':94B 'host':35B 'improp':7A,46B,166C 'improper-author':45B 'initi':172C 'inject':29B 'issu':149C 'like':81B 'local':114B 'maintain':75B 'maintainer-repo':74B 'manipul':164C 'packages/client/connection/src/browser-auth.ts':157C 'path':83B 'plaintext':91B 'plane':117B 'process':153C 'prompt':28B,129B 'prompt-inject':27B 'public':66B,73B 'rc.0':39B 'rc.2':42B,147C 'read':101B 'relat':82B 'remot':9A,60B,173C 'repo':76B 'report':57B 'respond':185C 'respons':71B 'sandbox':31B,97B 'sandbox-escap':30B 'secret':88B 'self':34B 'self-host':33B 'session':53B,110B 'sign':87B 'sit':89B 'skip':127B 'switch':119B 'tool':23B 'unknown':152C 'valid':109B 'vendor':70B,175C 'vuldb':56B 'vulner':138C 'way':188C 'without':62B","nicknames":[],"mitigations":[],"who_affected":"Teams running DeepSeek Harness (dsh) 0.2.0-rc.0 to rc.2 where the agent processes untrusted content (repos, web pages, MCP output) or the web UI is reachable from other machines. The credentials file is readable inside the workspace-write sandbox, so a prompt-injected agent can escape it. Setups bound only to loopback with no untrusted input are far less exposed. The sources do not confirm whether later builds are fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T16:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116368","severity":null,"published_at":"2026-10-26T16:17:18+00:00","modified_at":"2026-10-26T16:17:18+00:00","first_seen_at":"2026-10-26T16:31:01+00:00","fetched_at":"2026-10-26T16:31:01+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116368:836","url":null,"severity":null,"published_at":"2026-10-26T16:33:27+00:00","modified_at":"2026-10-26T16:33:27+00:00","first_seen_at":"2026-10-26T16:33:27+00:00","fetched_at":"2026-10-26T16:33:27+00:00","note":"No vendor advisory or fix exists (repo has no SECURITY.md/advisories; VulDB says vendor never responded). VulDB lists rc.0-rc.2 affected. Public GitHub Discussion #8678 (Oct 2) describes a closely matching issue in the same browser-session auth, but it does not cite this CVE, so the link is likely but unconfirmed. Nothing verified."}],"documents":[{"id":3965,"url":"https://vuldb.com/vuln/426332","title":"VulDB VDB-426332 CVE-2026-116368","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3966,"url":"https://github.com/deepseek-ai/deepseek-harness/discussions/8678","title":"Sandbox escape + approval bypass: browser-session signing secret readable from file sandbox (Discussion #8678)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}