CVE-2026-49393 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
OpenHuman is an open-source agent harness shipped as a desktop app and Rust library. Before 0.56.0, its Socket.IO rpc:request and chat:start handlers skip the bearer-token check that protects HTTP POST /rpc, so a client that can reach the socket can run the same methods without credentials.
first public Oct 9, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running OpenHuman before 0.56.0, whether the desktop app or a build that embeds the Rust library, is exposed through its local core server. The attack needs a local client that can connect to the Socket.IO namespace, so systems where only the local user can reach the service are the main concern. The sources do not say whether the default configuration binds the socket beyond localhost.
Not affected if version-0.56.0-or-later
Who cares ai-agents, desktop, openhuman, rust
0.56.0 is in range.0.56.0 or later.OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller path that rejects a missing bearer on /rpc. Depending on the selected method, the attacker can read configuration or health data, start agent flows, interact with integrated account APIs, alter local data, or stop and restart services. This issue is fixed in version 0.56.0.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.