{"id":"CVE-2026-125330","kind":"vulnerability","aliases":["CVE-2026-125330"],"related":[],"title":"HarnessRouter: workspace API keys read other workspaces' sessions and files","description":"HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.","summary":"HarnessRouter is a self-hosted unified API gateway for agent harnesses. Versions 0.4.2 through 0.31.7 check only the organization of a session or response ID, not the workspace, so a workspace API key holder who learns an ID from another workspace can read or change its sessions, files and traces.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agent-harness","ai-tooling","harnessrouter","self-hosted"],"not_affected_if":["default-workspace-keys-only","managed-hosting","single-workspace"],"how_to_check":"- Check the deployed HarnessRouter version against `0.31.7`\n- Review whether any workspace-scoped (non-default) API keys are issued in your organization, since only those keys are affected","fix":"- HarnessRouter: upgrade to `0.31.7`","status":"open","published_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:43:08+00:00","updated_at":"2026-11-10T19:43:08+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-10T19:43:08Z","model":"claude-haiku-5-5","output":{"fix":"- HarnessRouter: upgrade to `0.31.7`","reach":"network","title":"HarnessRouter: workspace API keys read other workspaces' sessions and files","impact":"medium","summary":"HarnessRouter is a self-hosted unified API gateway for agent harnesses. Versions 0.4.2 through 0.31.7 check only the organization of a session or response ID, not the workspace, so a workspace API key holder who learns an ID from another workspace can read or change its sessions, files and traces.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["self-hosted","harnessrouter","agent-harness"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Workspace key holder reads, overwrites or deletes other workspaces' sessions","analyst_note":"Confirm the fixed version and any workaround at the vendor patch and release notes links; sources give no exploitation status or product ecosystem details.","how_to_check":"- Check the deployed HarnessRouter version against `0.31.7`\n- Review whether any workspace-scoped (non-default) API keys are issued in your organization, since only those keys are affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["managed-hosting","single-workspace","default-workspace-keys-only"],"who_is_affected":"Teams that self-host HarnessRouter at versions 0.4.2 through 0.31.7 and issue non-default workspace API keys within one organization. Exposure requires a key holder to know a non-guessable session or response ID from another workspace; console users, organization keys and Default Workspace keys already have organization-wide access by design, and the flaw does not cross organization boundaries.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000784,"input_tokens":4698,"output_tokens":628,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-125330':13A,16A '-2026':12A,15A '0.31.7':42B,93C,188C '0.4.2':40B,91C 'accept':96C 'access':181C 'agent':18B,37B,87C 'agent-har':17B 'ai':21B 'ai-tool':20B 'anoth':67B,135C 'api':3A,34B,59B,85C,122C 'boundari':166C 'caller':106C 'cancel':152C 'chang':72B 'check':43B 'consol':168C 'convers':144C 'cross':164C 'cve':11A,14A 'default':120C,173C 'delet':154C 'enforc':112C 'file':10A,75B,146C,151C 'fix':185C 'gateway':35B 'guessabl':132C 'har':19B,38B,88C 'harnessrout':1A,23B,27B,78C 'holder':61B,126C 'host':26B,32B,83C 'id':52B,65B,99C,102C 'identifi':133C 'intent':176C 'issu':161C,183C 'key':4A,60B,123C,125C,171C,175C 'learn':63B,128C 'link':159C 'non':119C,131C 'non-default':118C 'non-guess':130C 'organ':46B,108C,140C,165C,170C,179C 'organization-wid':178C 'overwrit':150C 'publish':157C 'read':5A,70B,142C 'respons':51B,101C,149C 'retain':177C 'rout':94C 'scope':115C 'self':25B,31B,82C 'self-host':24B,30B,81C 'session':8A,49B,74B,98C,143C,155C 'share':158C 'tool':22B 'trace':77B,147C 'turn':145C 'unifi':33B,84C 'user':169C 'valid':103C 'version':39B,90C,187C 'wide':180C 'workspac':2A,7A,55B,58B,68B,114C,121C,136C,174C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host HarnessRouter at versions 0.4.2 through 0.31.7 and issue non-default workspace API keys within one organization. Exposure requires a key holder to know a non-guessable session or response ID from another workspace; console users, organization keys and Default Workspace keys already have organization-wide access by design, and the flaw does not cross organization boundaries.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentharness","aitooling","harnessrouter","high","selfhosted"],"campaign_type":null,"search_a":"'-125330':13A,16A '-2026':12A,15A 'api':3A 'cve':11A,14A 'file':10A 'harnessrout':1A 'key':4A 'read':5A 'session':8A 'workspac':2A,7A","search_b":"'0.31.7':42B '0.4.2':40B 'agent':18B,37B 'agent-har':17B 'ai':21B 'ai-tool':20B 'anoth':67B 'api':34B,59B 'chang':72B 'check':43B 'file':75B 'gateway':35B 'har':19B,38B 'harnessrout':23B,27B 'holder':61B 'host':26B,32B 'id':52B,65B 'key':60B 'learn':63B 'organ':46B 'read':70B 'respons':51B 'self':25B,31B 'self-host':24B,30B 'session':49B,74B 'tool':22B 'trace':77B 'unifi':33B 'version':39B 'workspac':55B,58B,68B","search_c":"'0.31.7':93C,188C '0.4.2':91C 'accept':96C 'access':181C 'agent':87C 'anoth':135C 'api':85C,122C 'boundari':166C 'caller':106C 'cancel':152C 'consol':168C 'convers':144C 'cross':164C 'default':120C,173C 'delet':154C 'enforc':112C 'file':146C,151C 'fix':185C 'guessabl':132C 'har':88C 'harnessrout':78C 'holder':126C 'host':83C 'id':99C,102C 'identifi':133C 'intent':176C 'issu':161C,183C 'key':123C,125C,171C,175C 'learn':128C 'link':159C 'non':119C,131C 'non-default':118C 'non-guess':130C 'organ':108C,140C,165C,170C,179C 'organization-wid':178C 'overwrit':150C 'publish':157C 'read':142C 'respons':101C,149C 'retain':177C 'rout':94C 'scope':115C 'self':82C 'self-host':81C 'session':98C,143C,155C 'share':158C 'trace':147C 'turn':145C 'unifi':84C 'user':169C 'valid':103C 'version':90C,187C 'wide':180C 'workspac':114C,121C,136C,174C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-06T21:32:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125330","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125330","severity":null,"published_at":"2026-11-10T19:21:10+00:00","modified_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[{"id":117490,"url":"https://github.com/HarnessRouter/harnessrouter/commit/249c6cc9ab51a24a78f4e9809d356718f2ef74b1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117491,"url":"https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.7","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117492,"url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9pjr-97x3-c4wv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-06T21:32:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}