{"id":"CVE-2026-49407","kind":"vulnerability","aliases":["CVE-2026-49407"],"related":[],"title":"OpenHuman: unauthenticated dictation WebSocket lets web pages exhaust resources","description":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.44, its local  /ws/dictation  WebSocket endpoint lacks client authentication and browser-origin validation. An unauthenticated client, including a malicious web page able to reach the endpoint, can submit audio and trigger resource-intensive speech-to-text processing. Earlier affected versions also accumulate audio in an unbounded buffer, allowing continuous streaming to exhaust process memory. These conditions can degrade performance, exhaust resources, or crash the application. This issue is fixed in version 0.57.44.","summary":"OpenHuman, an open-source AI agent harness with a desktop app, exposes a local /ws/dictation WebSocket endpoint without client authentication or browser-origin checks. A malicious web page or any client reaching it can stream audio to trigger heavy speech-to-text work and unbounded buffering, crashing or slowing the app.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","desktop","openhuman","rust"],"not_affected_if":["version-0.57.44-or-later"],"how_to_check":"- Check the installed OpenHuman desktop app or Rust library version against the fixed version below.\n- Look for a local WebSocket endpoint at /ws/dictation in the running application.","fix":"- OpenHuman: upgrade to `0.57.44` or later.","status":"open","published_at":"2026-11-05T17:18:18+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","triaged_at":"2026-11-05T17:42:20+00:00","updated_at":"2026-11-05T17:42:21+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-05T17:42:20Z","model":"claude-haiku-5-5","output":{"fix":"- OpenHuman: upgrade to `0.57.44` or later.","reach":"local","title":"OpenHuman: unauthenticated dictation WebSocket lets web pages exhaust resources","impact":"medium","summary":"OpenHuman, an open-source AI agent harness with a desktop app, exposes a local /ws/dictation WebSocket endpoint without client authentication or browser-origin checks. A malicious web page or any client reaching it can stream audio to trigger heavy speech-to-text work and unbounded buffering, crashing or slowing the app.","audience":"everyone","category":"ai-tooling","nicknames":[],"who_cares":["openhuman","desktop","ai-agents","rust"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Application crashes or memory is exhausted through the local endpoint","analyst_note":"","how_to_check":"- Check the installed OpenHuman desktop app or Rust library version against the fixed version below.\n- Look for a local WebSocket endpoint at /ws/dictation in the running application.","plain_action":"Update OpenHuman to version 0.57.44 or later.","needs_analyst":false,"not_affected_if":["version-0.57.44-or-later"],"who_is_affected":"Anyone running an OpenHuman desktop build older than 0.57.44 or a Rust library build older than that version, where the dictation endpoint is reachable. A malicious web page open in a browser on the same machine can reach it, so the exposure is local to the machine running the app. Teams that do not run OpenHuman can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4376,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-49407':12A,15A '/ws/dictation':40B,100C '0.57.44':97C,171C 'abl':119C 'accumul':141C 'affect':138C 'agent':18B,31B,85C 'ai':17B,20B,30B 'ai-ag':16B 'ai-tool':19B 'allow':147C 'also':140C 'app':36B,78B 'applic':91C,164C 'audio':62B,126C,142C 'authent':45B,105C 'avail':87C 'browser':48B,108C 'browser-origin':47B,107C 'buffer':73B,146C 'check':50B 'client':44B,57B,104C,113C 'condit':155C 'continu':148C 'crash':74B,162C 'cve':10A,13A 'degrad':157C 'desktop':22B,35B,90C 'dictat':3A 'earlier':137C 'endpoint':42B,102C,123C 'exhaust':8A,151C,159C 'expos':37B 'fix':168C 'har':32B,86C 'heavi':65B 'includ':114C 'intens':131C 'issu':166C 'lack':103C 'let':5A 'librari':94C 'local':39B,99C 'malici':52B,116C 'memori':153C 'open':28B,83C 'open-sourc':27B,82C 'openhuman':1A,23B,25B,79C 'origin':49B,109C 'page':7A,54B,118C 'perform':158C 'process':136C,152C 'reach':58B,121C 'resourc':9A,130C,160C 'resource-intens':129C 'rust':24B,93C 'slow':76B 'sourc':29B,84C 'speech':67B,133C 'speech-to-text':66B,132C 'stream':61B,149C 'submit':125C 'text':69B,135C 'tool':21B 'trigger':64B,128C 'unauthent':2A,112C 'unbound':72B,145C 'valid':110C 'version':96C,139C,170C 'web':6A,53B,117C 'websocket':4A,41B,101C 'without':43B 'work':70B","nicknames":[],"mitigations":[],"who_affected":"Anyone running an OpenHuman desktop build older than 0.57.44 or a Rust library build older than that version, where the dictation endpoint is reachable. A malicious web page open in a browser on the same machine can reach it, so the exposure is local to the machine running the app. Teams that do not run OpenHuman can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update OpenHuman to version 0.57.44 or later.","pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","desktop","high","openhuman","rust"],"campaign_type":null,"first_public_at":"2026-10-09T17:35:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-49407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49407","severity":null,"published_at":"2026-11-05T17:18:18+00:00","modified_at":"2026-11-05T17:18:18+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","fetched_at":"2026-11-05T17:40:04+00:00","note":null}],"documents":[{"id":78099,"url":"https://github.com/tinyhumansai/openhuman/commit/2944b83fc0da61edb3c461243593cdb64de74efe","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78100,"url":"https://github.com/tinyhumansai/openhuman/commit/cf5dd2d7c7897218e704c58268fc48decb63202c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78101,"url":"https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.44","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78102,"url":"https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-mfwq-rpj4-38xh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-09T17:35:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}