CVE-2026-114361

MediumCVSS 5.6

Published: 21/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

A vulnerability was detected in HarnessRouter up to 0.31.10 in the file gateway/app.py of the Identity Mode component. Manipulating the X-Harness-Org/X-Harness-Member arguments results in improper authorization. The attack is remotely possible, with high complexity and difficult exploitability.

Risk Assessment

Improper authorization may allow an attacker to bypass access controls and reach resources or operations they should not be permitted to use. Because the attack is remote, the organization is exposed to privilege escalation within the system.

Recommendation

Upgrade HarnessRouter to version 0.31.11 or apply patch 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. Verify that the Identity Mode component is properly configured.

Other vulnerabilities in HarnessRouter

CVE-2026-114362Medium
A flaw was found in HarnessRouter up to 0.31.12 affecting an unknown function in gateway/app.py of the Targets Test Endpoint component. Manipulating the base_url argument can lead to server-side request forgery, exploitable remotely.

Original NVD description (English source)

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS