{"id":"CVE-2026-125331","kind":"vulnerability","aliases":["CVE-2026-125331"],"related":[],"title":"HarnessRouter: forged bearer lets a remote caller hijack another org's AI connection","description":"HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.","summary":"HarnessRouter is a self-hosted API for running AI agent harnesses across sessions and streams. Before 0.31.8, a request with any made-up bearer token can rewrite another organization's model provider connection to an attacker-controlled endpoint, so prompts are leaked and attacker responses steer tasks.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agent-harness","ai-tooling","multi-tenant","self-hosted"],"not_affected_if":["self-hosted-mode","single-organization-deployment","version-0.31.8-or-later"],"how_to_check":"- Check the installed HarnessRouter version against `0.31.8`\n- Confirm whether the deployment is multi-organization and not running in self-hosted mode\n- Review whether the internet can reach the PUT `/v1/orgs/{org}/connections/{name}` and `/internal/*` routes","fix":"- HarnessRouter: upgrade to `0.31.8`","status":"open","published_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","triaged_at":"2026-11-10T19:25:48+00:00","updated_at":"2026-11-10T19:25:48+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-10T19:25:48Z","model":"claude-haiku-5-5","output":{"fix":"- HarnessRouter: upgrade to `0.31.8`","reach":"internet","title":"HarnessRouter: forged bearer lets a remote caller hijack another org's AI connection","impact":"high","summary":"HarnessRouter is a self-hosted API for running AI agent harnesses across sessions and streams. Before 0.31.8, a request with any made-up bearer token can rewrite another organization's model provider connection to an attacker-controlled endpoint, so prompts are leaked and attacker responses steer tasks.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["ai-tooling","agent-harness","self-hosted","multi-tenant"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker rewrites provider connection, reading prompts and steering agent tasks","analyst_note":"Confirm from the linked patch and vendor advisory whether the exposure requires a multi-organization deployment and whether single-org installs are unaffected.","how_to_check":"- Check the installed HarnessRouter version against `0.31.8`\n- Confirm whether the deployment is multi-organization and not running in self-hosted mode\n- Review whether the internet can reach the PUT `/v1/orgs/{org}/connections/{name}` and `/internal/*` routes","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-organization-deployment","self-hosted-mode","version-0.31.8-or-later"],"who_is_affected":"Deployments of HarnessRouter before 0.31.8 that serve more than one organization and have a console not in self-hosted mode are exposed. The flaw is reachable by any remote caller who can reach the API, because the forged bearer is accepted before validation. Single-organization self-hosted installs are described as not the target of the flaw, though the sources do not state this explicitly.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000818,"input_tokens":4767,"output_tokens":683,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125331':16A,19A '-2026':15A,18A '/connections':141C '/internal':149C '/policy':146C '/v1/orgs':139C,144C '0.31.8':49B,104C,210C 'across':44B 'agent':21B,42B,92C 'agent-har':20B 'ai':12A,24B,41B 'ai-tool':23B 'anoth':9A,61B,179C 'api':38B,89C 'attach':115C 'attack':70B,78B,187C,198C 'attacker-control':69B,186C,197C 'author':125C 'backend':147C 'bearer':3A,57B,130C,176C 'caller':7A,169C 'cancel':98C 'carri':123C 'caus':190C 'connect':13A,66B,183C 'consol':106C 'control':71B,188C,199C 'cve':14A,17A 'deploy':166C 'disclos':195C 'endpoint':72B,189C 'failur':100C 'file':97C 'fix':207C 'forg':2A 'get':138C 'handl':101C 'har':22B,43B,93C 'harnessrout':1A,32B,82C 'header':126C 'hijack':8A 'host':31B,37B,87C,113C 'influenc':202C 'intern':119C 'issu':205C 'key':120C,153C 'later':191C 'leak':76B 'let':4A 'made':55B,174C 'made-up':54B,173C 'mode':114C 'model':64B 'multi':27B,164C 'multi-organ':163C 'multi-ten':26B 'name':142C 'org':10A,140C,145C 'organ':62B,157C,165C,180C 'prior':102C 'prompt':74B,192C 'provid':65B,182C 'put':136C,143C 'remot':6A,168C 'request':51B,122C 'respons':79B,200C 'rewrit':60B,178C 'rout':150C 'run':40B,91C 'self':30B,36B,86C,112C 'self-host':29B,35B,85C,111C 'server':117C 'servic':134C 'service-on':133C 'session':45B,95C 'steer':80B 'stream':47B,96C 'take':155C 'task':81B,203C 'tenant':28B 'token':58B 'tool':25B 'trust':151C 'unifi':88C 'url':160C 'use':171C 'valid':128C 'version':209C","nicknames":[],"mitigations":[],"who_affected":"Deployments of HarnessRouter before 0.31.8 that serve more than one organization and have a console not in self-hosted mode are exposed. The flaw is reachable by any remote caller who can reach the API, because the forged bearer is accepted before validation. Single-organization self-hosted installs are described as not the target of the flaw, though the sources do not state this explicitly.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentharness","aitooling","critical","multitenant","selfhosted"],"campaign_type":null,"search_a":"'-125331':16A,19A '-2026':15A,18A 'ai':12A 'anoth':9A 'bearer':3A 'caller':7A 'connect':13A 'cve':14A,17A 'forg':2A 'harnessrout':1A 'hijack':8A 'let':4A 'org':10A 'remot':6A","search_b":"'0.31.8':49B 'across':44B 'agent':21B,42B 'agent-har':20B 'ai':24B,41B 'ai-tool':23B 'anoth':61B 'api':38B 'attack':70B,78B 'attacker-control':69B 'bearer':57B 'connect':66B 'control':71B 'endpoint':72B 'har':22B,43B 'harnessrout':32B 'host':31B,37B 'leak':76B 'made':55B 'made-up':54B 'model':64B 'multi':27B 'multi-ten':26B 'organ':62B 'prompt':74B 'provid':65B 'request':51B 'respons':79B 'rewrit':60B 'run':40B 'self':30B,36B 'self-host':29B,35B 'session':45B 'steer':80B 'stream':47B 'task':81B 'tenant':28B 'token':58B 'tool':25B","search_c":"'/connections':141C '/internal':149C '/policy':146C '/v1/orgs':139C,144C '0.31.8':104C,210C 'agent':92C 'anoth':179C 'api':89C 'attach':115C 'attack':187C,198C 'attacker-control':186C,197C 'author':125C 'backend':147C 'bearer':130C,176C 'caller':169C 'cancel':98C 'carri':123C 'caus':190C 'connect':183C 'consol':106C 'control':188C,199C 'deploy':166C 'disclos':195C 'endpoint':189C 'failur':100C 'file':97C 'fix':207C 'get':138C 'handl':101C 'har':93C 'harnessrout':82C 'header':126C 'host':87C,113C 'influenc':202C 'intern':119C 'issu':205C 'key':120C,153C 'later':191C 'made':174C 'made-up':173C 'mode':114C 'multi':164C 'multi-organ':163C 'name':142C 'org':140C,145C 'organ':157C,165C,180C 'prior':102C 'prompt':192C 'provid':182C 'put':136C,143C 'remot':168C 'request':122C 'respons':200C 'rewrit':178C 'rout':150C 'run':91C 'self':86C,112C 'self-host':85C,111C 'server':117C 'servic':134C 'service-on':133C 'session':95C 'stream':96C 'take':155C 'task':203C 'trust':151C 'unifi':88C 'url':160C 'use':171C 'valid':128C 'version':209C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-06T21:59:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125331","severity":null,"published_at":"2026-11-10T19:21:10+00:00","modified_at":"2026-11-10T19:21:10+00:00","first_seen_at":"2026-11-10T19:25:14+00:00","fetched_at":"2026-11-10T19:25:14+00:00","note":null}],"documents":[{"id":117493,"url":"https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":117494,"url":"https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":117495,"url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-06T21:59:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}