CVE-2026-125330 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
HarnessRouter is a self-hosted unified API gateway for agent harnesses. Versions 0.4.2 through 0.31.7 check only the organization of a session or response ID, not the workspace, so a workspace API key holder who learns an ID from another workspace can read or change its sessions, files and traces.
first public Oct 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host HarnessRouter at versions 0.4.2 through 0.31.7 and issue non-default workspace API keys within one organization. Exposure requires a key holder to know a non-guessable session or response ID from another workspace; console users, organization keys and Default Workspace keys already have organization-wide access by design, and the flaw does not cross organization boundaries.
Not affected if default-workspace-keys-only, managed-hosting, single-workspace
Who cares agent-harness, harnessrouter, self-hosted
0.31.70.31.7HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.