CVE-2026-49407 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
OpenHuman, an open-source AI agent harness with a desktop app, exposes a local /ws/dictation WebSocket endpoint without client authentication or browser-origin checks. A malicious web page or any client reaching it can stream audio to trigger heavy speech-to-text work and unbounded buffering, crashing or slowing the app.
first public Oct 9, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Anyone running an OpenHuman desktop build older than 0.57.44 or a Rust library build older than that version, where the dictation endpoint is reachable. A malicious web page open in a browser on the same machine can reach it, so the exposure is local to the machine running the app. Teams that do not run OpenHuman can skip it.
Not affected if version-0.57.44-or-later
Who cares ai-agents, desktop, openhuman, rust
0.57.44 or later.OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local /ws/dictation WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.