{"id":"CVE-2026-49393","kind":"vulnerability","aliases":["CVE-2026-49393"],"related":[],"title":"OpenHuman agent harness: unauthenticated local Socket.IO calls bypass bearer auth","description":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller path that rejects a missing bearer on /rpc. Depending on the selected method, the attacker can read configuration or health data, start agent flows, interact with integrated account APIs, alter local data, or stop and restart services. This issue is fixed in version 0.56.0.","summary":"OpenHuman is an open-source agent harness shipped as a desktop app and Rust library. Before 0.56.0, its Socket.IO rpc:request and chat:start handlers skip the bearer-token check that protects HTTP POST /rpc, so a client that can reach the socket can run the same methods without credentials.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","desktop","openhuman","rust"],"not_affected_if":["version-0.56.0-or-later"],"how_to_check":"- Check the installed OpenHuman version (desktop app about screen or the Rust crate version in Cargo.lock); anything below `0.56.0` is in range.\n- Look for a core server listening on a local port that accepts Socket.IO connections to the rpc namespace without a token.","fix":"- Upgrade OpenHuman to `0.56.0` or later.","status":"open","published_at":"2026-11-05T17:18:16+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","triaged_at":"2026-11-05T17:42:13+00:00","updated_at":"2026-11-05T17:42:13+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-05T17:42:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade OpenHuman to `0.56.0` or later.","reach":"local","title":"OpenHuman agent harness: unauthenticated local Socket.IO calls bypass bearer auth","impact":"high","summary":"OpenHuman is an open-source agent harness shipped as a desktop app and Rust library. Before 0.56.0, its Socket.IO rpc:request and chat:start handlers skip the bearer-token check that protects HTTP POST /rpc, so a client that can reach the socket can run the same methods without credentials.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["openhuman","rust","desktop","ai-agents"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"local client reads config, alters data, or stops services","analyst_note":"Confirm the default bind address of the Socket.IO server and whether the desktop app exposes it beyond localhost; check the linked patch at github.com for the exact fixed change.","how_to_check":"- Check the installed OpenHuman version (desktop app about screen or the Rust crate version in Cargo.lock); anything below `0.56.0` is in range.\n- Look for a core server listening on a local port that accepts Socket.IO connections to the rpc namespace without a token.","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.56.0-or-later"],"who_is_affected":"Anyone running OpenHuman before 0.56.0, whether the desktop app or a build that embeds the Rust library, is exposed through its local core server. The attack needs a local client that can connect to the Socket.IO namespace, so systems where only the local user can reach the service are the main concern. The sources do not say whether the default configuration binds the socket beyond localhost.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000763,"input_tokens":4379,"output_tokens":650,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-49393':13A,16A '/rpc':62B,104C,150C '0.56.0':43B,95C,186C 'account':170C 'agent':2A,19B,32B,84C,165C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'alter':172C 'api':171C 'app':38B 'applic':90C 'attack':157C 'auth':10A 'authent':124C 'avail':86C 'bearer':9A,55B,106C,148C 'bearer-token':54B 'bypass':8A 'call':7A 'chat':49B,114C 'check':57B 'client':65B,128C 'configur':160C 'connect':130C 'control':142C 'core':97C 'credenti':77B 'cve':11A,14A 'data':163C,174C 'depend':151C 'desktop':23B,37B,89C 'dispatch':136C 'equival':118C 'expos':109C 'fix':183C 'flow':166C 'handler':51B,116C,122C 'handler-level':121C 'har':3A,33B,85C 'health':162C 'http':60B,100C 'integr':169C 'interact':167C 'issu':181C 'level':123C 'librari':41B,93C 'local':5A,126C,173C 'method':75B,155C 'middlewar':107C 'miss':147C 'namespac':134C 'open':30B,82C 'open-sourc':29B,81C 'openhuman':1A,24B,26B,78C 'path':143C 'post':61B,101C 'protect':59B,99C,141C 'reach':68B 'read':159C 'reject':145C 'request':47B,102C,112C,137C 'restart':178C 'rpc':46B,111C 'run':72B 'rust':25B,40B,92C 'select':154C 'server':98C 'servic':179C 'ship':34B 'skip':52B 'socket':70B 'socket.io':6A,45B,110C,133C 'sourc':31B,83C 'start':50B,115C,164C 'stop':176C 'token':56B 'tool':22B 'transport':119C 'unauthent':4A,127C 'version':185C 'without':76B,117C","nicknames":[],"mitigations":[],"who_affected":"Anyone running OpenHuman before 0.56.0, whether the desktop app or a build that embeds the Rust library, is exposed through its local core server. The attack needs a local client that can connect to the Socket.IO namespace, so systems where only the local user can reach the service are the main concern. The sources do not say whether the default configuration binds the socket beyond localhost.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","desktop","high","openhuman","rust"],"campaign_type":null,"first_public_at":"2026-10-09T17:35:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49393","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49393","severity":null,"published_at":"2026-11-05T17:18:16+00:00","modified_at":"2026-11-05T17:18:16+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","fetched_at":"2026-11-05T17:40:04+00:00","note":null}],"documents":[{"id":43893,"url":"https://github.com/tinyhumansai/openhuman/commit/b1bbc53fceed7d1f0cff90cbb0a42f4ab8e153a1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43894,"url":"https://github.com/tinyhumansai/openhuman/releases/tag/v0.56.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78095,"url":"https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-49xv-q9pm-v2qm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-09T17:35:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}