{"id":"CVE-2026-82033","kind":"vulnerability","aliases":["CVE-2026-82033"],"related":[],"title":"DeepSeek Harness: missing authentication lets local processes run commands","description":"DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.","summary":"DeepSeek Harness has an unauthenticated web control interface, so any local process can create sessions and send prompts. An attacker can use the agent's shell and file tools to run arbitrary commands as the victim user, read live session traffic, and bypass tool-approval checks.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","deepseek-harness","local-agents","self-hosted"],"not_affected_if":["patched-version","web-profile-disabled"],"how_to_check":"- Check the installed version against the product range in the NVD entry (prior to 0.1.2-alpha.2)\n- Check whether commit `3e24087` is included in the deployed build\n- Check whether the web profile HTTP and WebSocket RPC interface is running on the machine","fix":"- DeepSeek Harness: move to `0.1.2-alpha.2` or later","status":"open","published_at":"2026-11-04T19:17:41+00:00","first_seen_at":"2026-11-04T19:28:49+00:00","triaged_at":"2026-11-04T19:30:06+00:00","updated_at":"2026-11-04T19:30:06+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-04T19:30:06Z","model":"claude-haiku-5-5","output":{"fix":"- DeepSeek Harness: move to `0.1.2-alpha.2` or later","reach":"local","title":"DeepSeek Harness: missing authentication lets local processes run commands","impact":"high","summary":"DeepSeek Harness has an unauthenticated web control interface, so any local process can create sessions and send prompts. An attacker can use the agent's shell and file tools to run arbitrary commands as the victim user, read live session traffic, and bypass tool-approval checks.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["deepseek-harness","self-hosted","local-agents"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"arbitrary command execution as the victim user, with model credentials exposed","analyst_note":"Confirm whether the web profile is enabled by default and the exact default bind address, using the linked patch and release notes on github.com.","how_to_check":"- Check the installed version against the product range in the NVD entry (prior to 0.1.2-alpha.2)\n- Check whether commit `3e24087` is included in the deployed build\n- Check whether the web profile HTTP and WebSocket RPC interface is running on the machine","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version","web-profile-disabled"],"who_is_affected":"Any machine running DeepSeek Harness with the web profile enabled is exposed, since the control plane accepts unauthenticated requests from local processes, including ones under other OS users. Teams running it only from the CLI without the web profile, or on an already-patched version, can skip it. The sources do not say whether the web profile is on by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4321,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-82033':12A,15A '/api/respond':168C '0.1.2':79C '3e24087':84C 'achiev':135C 'agent':24B,51B,129C 'ai':17B 'ai-tool':16B 'allow':100C 'alpha.2':80C 'approv':73B,164C 'approvalid':173C 'arbitrari':59B,136C 'attack':47B,122C 'authent':4A,88C 'bash':131C 'broadcast':177C 'bypass':70B,160C 'check':74B,165C 'command':9A,60B,137C 'commit':83C 'configur':145C 'contain':85C 'control':34B,98C 'creat':41B 'credenti':147C 'cve':10A,13A 'deepseek':1A,20B,28B,75C 'deepseek-har':19B 'differ':109C 'event':156C 'execut':138C 'file':55B 'filesystem':133C 'har':2A,21B,29B,76C 'host':27B 'http':94C 'human':161C 'includ':104C 'intercept':148C 'interfac':35B 'invok':124C 'let':5A 'live':66B,149C 'local':6A,23B,38B,102C 'local-ag':22B 'log':153C 'match':170C 'method':116C 'miss':3A,87C 'model':146C 'mux':157C 'os':110C 'plane':99C 'post':167C 'prior':77C 'process':7A,39B,103C 'profil':93C 'prompt':45B 'reach':113C 'read':65B 'rpc':97C 'rpcid':172C 'run':8A,58B,106C 'self':26B 'self-host':25B 'send':44B 'session':42B,67B,115C,150C 'session.create':119C 'session.prompt':121C,125C 'sessionid':175C 'shell':53B 'specif':82C 'stream':158C,181C 'tool':18B,56B,72B,134C,163C 'tool-approv':71B,162C 'traffic':68B,151C 'trigger':127C 'unauthent':32B,114C 'ungat':180C 'use':49B,143C 'user':64B,111C,142C 'valu':176C 'via':166C 'victim':63B,141C 'vulner':89C 'web':33B,92C 'websocket':96C","nicknames":[],"mitigations":[],"who_affected":"Any machine running DeepSeek Harness with the web profile enabled is exposed, since the control plane accepts unauthenticated requests from local processes, including ones under other OS users. Teams running it only from the CLI without the web profile, or on an already-patched version, can skip it. The sources do not say whether the web profile is on by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","deepseekharness","high","localagents","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T19:17:41+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82033","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82033","severity":null,"published_at":"2026-11-04T19:17:41+00:00","modified_at":"2026-11-04T19:17:41+00:00","first_seen_at":"2026-11-04T19:28:49+00:00","fetched_at":"2026-11-04T19:28:49+00:00","note":null}],"documents":[{"id":69752,"url":"https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":69753,"url":"https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":69754,"url":"https://www.vulncheck.com/advisories/deepseek-harness-unauthenticated-rpc-command-execution","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}