CVE-2026-114362

MediumCVSS 6.3

Published: 21/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

A flaw was found in HarnessRouter up to 0.31.12 affecting an unknown function in gateway/app.py of the Targets Test Endpoint component. Manipulating the base_url argument can lead to server-side request forgery, exploitable remotely.

Risk Assessment

An attacker can force the server to make requests to arbitrary resources, potentially exposing internal services or bypassing network controls.

Recommendation

Upgrade HarnessRouter to version 0.31.13 containing patch 1c4b1fc1f89737dabd089ac1d1c174a57f764e28.

Other vulnerabilities in HarnessRouter

CVE-2026-114361Medium
A vulnerability was detected in HarnessRouter up to 0.31.10 in the file gateway/app.py of the Identity Mode component. Manipulating the X-Harness-Org/X-Harness-Member arguments results in improper authorization. The attack is remotely possible, with high complexity and difficult exploitability.

Original NVD description (English source)

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS