---
id: "CVE-2026-49393"
kind: "vulnerability"
aliases: ["CVE-2026-49393"]
title: "OpenHuman agent harness: unauthenticated local Socket.IO calls bypass bearer auth"
severity: "high"
cvss: 8.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-agents", "ai-tooling", "desktop", "openhuman", "rust"]
not_affected_if: ["version-0.56.0-or-later"]
published_at: "2026-11-05T17:18:16+00:00"
first_seen_at: "2026-11-05T17:40:04+00:00"
updated_at: "2026-11-05T17:42:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49393", "first_seen_at": "2026-11-05T17:40:04+00:00"}]
exploit_sources: []
---

# OpenHuman agent harness: unauthenticated local Socket.IO calls bypass bearer auth

OpenHuman is an open-source agent harness shipped as a desktop app and Rust library. Before 0.56.0, its Socket.IO rpc:request and chat:start handlers skip the bearer-token check that protects HTTP POST /rpc, so a client that can reach the socket can run the same methods without credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OpenHuman version (desktop app about screen or the Rust crate version in Cargo.lock); anything below `0.56.0` is in range.
- Look for a core server listening on a local port that accepts Socket.IO connections to the rpc namespace without a token.

## Fix

- Upgrade OpenHuman to `0.56.0` or later.

## Timeline

- 2026-11-05T17:40:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-49393

## Documents

- [advisory] Vendor advisory: github.com https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-49xv-q9pm-v2qm
- [fix] Patch: github.com https://github.com/tinyhumansai/openhuman/commit/b1bbc53fceed7d1f0cff90cbb0a42f4ab8e153a1
- [fix] Release notes: github.com https://github.com/tinyhumansai/openhuman/releases/tag/v0.56.0

## From the sources

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller path that rejects a missing bearer on /rpc. Depending on the selected method, the attacker can read configuration or health data, start agent flows, interact with integrated account APIs, alter local data, or stop and restart services. This issue is fixed in version 0.56.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_