CVE-2026-49407

In OpenHuman from 0.53.15 before 0.57.5 on macOS, core_process.rs publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in the process environment even though the core runs as an in-process task. Another process running as the same user can read that environment through the macOS KERN_PROCARGS2 interface and recover the token together with the local host and port.

In OpenHuman before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation.

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDisplayMedia without a live user gesture. Instead of rejecting the request, the shim falls through to native Chromium capture behavior, and the embedded CEF environment can auto-select the primary display because it lacks the normal desktop-media picker. If OpenHuman already has macOS Screen Recording permission and an attacker obtains JavaScript execution in an allowed embedded origin, the attacker can obtain a real desktop capture stream without a new user gesture.

In OpenHuman before 0.57.13, background synchronization for connected services such as email, Slack, and Notion stores raw external content and places it in the model context of autonomous background agents without neutralizing embedded instructions. ApprovalGate treats tool calls without an interactive chat context as pre-authorized automation, so attacker-authored content can influence the model to invoke Composio actions without an approval request.

In OpenHuman before 0.57.13, names, descriptions, titles, and parameter definitions returned by configured external MCP servers are placed into the agent model context without neutralizing instructions or bounding descriptive fields. Tool filtering considers the tool name, and the prompt-injection detector screens user messages rather than MCP definitions.

OpenHuman before 0.56.0 exposes the local server-sent events endpoint /events without bearer authentication, permits cross-origin browser access, and selects WebChannelEvent objects solely by a caller-supplied client_id. An unauthenticated local client or an attacker-hosted web page opened by the victim can subscribe to another client's stream and read complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs.

In OpenHuman before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller path that rejects a missing bearer on /rpc.

In OpenHuman before version 0.57.13, an attacker able to send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. Command validation also permits leading environment assignments that can redirect allowed commands to executable helpers.

In OpenHuman before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic AgentTurnRequest using the default tool policy without an interactive approval context. ApprovalGate treats missing APPROVAL_CHAT_CONTEXT as a non-interactive turn and allows node_exec to run despite the default Supervised policy requiring approval.

The shell tool command allowlist in the SecurityPolicy of OpenHuman desktop agent through 0.54.0 (default Supervised security policy) can be bypassed to execute arbitrary OS commands with the privileges of the desktop user.