CVE-2026-125331 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
HarnessRouter is a self-hosted API for running AI agent harnesses across sessions and streams. Before 0.31.8, a request with any made-up bearer token can rewrite another organization's model provider connection to an attacker-controlled endpoint, so prompts are leaked and attacker responses steer tasks.
first public Oct 6, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Deployments of HarnessRouter before 0.31.8 that serve more than one organization and have a console not in self-hosted mode are exposed. The flaw is reachable by any remote caller who can reach the API, because the forged bearer is accepted before validation. Single-organization self-hosted installs are described as not the target of the flaw, though the sources do not state this explicitly.
Not affected if self-hosted-mode, single-organization-deployment, version-0.31.8-or-later
Who cares agent-harness, multi-tenant, self-hosted
0.31.8/v1/orgs/{org}/connections/{name} and /internal/* routes0.31.8HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.