CVE-2026-125330

HarnessRouter is a self-hosted unified API for agent harnesses.

HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-125330