{"id":"CVE-2026-54145","kind":"vulnerability","aliases":["CVE-2026-54145"],"related":[],"title":"OpenHuman agent harness leaks its RPC bearer token through approval records","description":"OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.","summary":"OpenHuman is an open-source agent harness for desktop and Rust. Before version 0.57.5 its approval gate reuses the JSON-RPC bearer token as an approval session identifier, so the token is written into approval records, events, debug logs and RPC responses.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["agent-harness","ai-tooling","desktop","openhuman","rust"],"not_affected_if":["version-0.57.5-or-later"],"how_to_check":"- Check the installed OpenHuman version against the fixed release `0.57.5`\n- Look for the token in persisted approval records and debug logs on the desktop machine (locations not stated in sources: unknown)","fix":"- OpenHuman: move to version `0.57.5` or later","status":"open","published_at":"2026-11-05T17:18:19+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","triaged_at":"2026-11-05T17:42:08+00:00","updated_at":"2026-11-05T17:42:08+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-05T17:42:08Z","model":"claude-haiku-5-5","output":{"fix":"- OpenHuman: move to version `0.57.5` or later","reach":"unknown","title":"OpenHuman agent harness leaks its RPC bearer token through approval records","impact":"high","summary":"OpenHuman is an open-source agent harness for desktop and Rust. Before version 0.57.5 its approval gate reuses the JSON-RPC bearer token as an approval session identifier, so the token is written into approval records, events, debug logs and RPC responses.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["openhuman","desktop","rust","agent-harness"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker reads token and runs privileged core RPC operations","analyst_note":"Confirm the affected version range and token rotation steps in the vendor advisory and release notes linked from the sources.","how_to_check":"- Check the installed OpenHuman version against the fixed release `0.57.5`\n- Look for the token in persisted approval records and debug logs on the desktop machine (locations not stated in sources: unknown)","plain_action":"","needs_analyst":true,"not_affected_if":["version-0.57.5-or-later"],"who_is_affected":"Anyone running OpenHuman before version 0.57.5 on a desktop, since the approval flow exposes the RPC token during normal operation. An attacker who reads the persisted logs or records can use the token while it remains valid, and stable tokens stay valid until rotated. Systems on a current version are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4374,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-54145':14A,17A '0.57.5':41B,91C,183C 'access':137C 'activ':176C 'affect':88C 'agent':2A,19B,33B,77C,150C 'agent-har':18B 'ai':22B 'ai-tool':21B 'applic':83C 'approv':10A,43B,54B,63B,93C,104C,113C 'artifact':131C 'attack':127C 'avail':79C 'bearer':7A,50B,100C 'core':139C,173C 'correspond':172C 'credenti':110C 'cve':12A,15A 'data':153C 'debug':66B,116C 'desktop':24B,36B,82C,124C 'event':65B,115C 'expos':108C,148C 'fix':178C 'gate':44B,94C 'har':3A,20B,34B,78C 'identifi':56B,106C 'includ':121C,180C 'instanc':174C 'integr':152C 'interfac':141C 'json':48B,98C 'json-rpc':47B,97C 'launch':165C 'launch-specif':164C 'leak':4A 'librari':86C 'log':67B,117C 'normal':123C 'obtain':129C 'open':31B,75C 'open-sourc':30B,74C 'openhuman':1A,25B,27B,71C 'oper':125C,157C 'permit':155C 'persist':112C 'privileg':156C 'record':11A,64B,114C 'recov':133C 'remain':144C,160C,168C 'respons':70B,120C 'reus':45B 'rotat':163C 'rpc':6A,49B,69B,99C,119C,140C 'rust':26B,38B,85C 'sensit':149C 'session':55B,105C 'sourc':32B,76C 'specif':166C 'stabl':158C 'token':8A,51B,59B,101C,135C,159C,167C 'tool':23B 'usabl':161C,169C 'use':95C 'valid':145C 'version':40B,89C,182C 'written':61B","nicknames":[],"mitigations":[],"who_affected":"Anyone running OpenHuman before version 0.57.5 on a desktop, since the approval flow exposes the RPC token during normal operation. An attacker who reads the persisted logs or records can use the token while it remains valid, and stable tokens stay valid until rotated. Systems on a current version are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["agentharness","aitooling","desktop","high","openhuman","rust"],"campaign_type":null,"first_public_at":"2026-10-09T17:35:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-54145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54145","severity":null,"published_at":"2026-11-05T17:18:19+00:00","modified_at":"2026-11-05T17:18:19+00:00","first_seen_at":"2026-11-05T17:40:04+00:00","fetched_at":"2026-11-05T17:40:04+00:00","note":null}],"documents":[{"id":78119,"url":"https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":78120,"url":"https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":78121,"url":"https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-09T17:35:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}