HarnessRouter vulnerabilities
We track 2 vulnerabilities in HarnessRouter products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on November 10, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest HarnessRouter vulnerabilities
- 9.1 Critical severity
harnessrouter: Missing Authorization
HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Au
- 7.5 High severity
harnessrouter: Authorization Bypass Through User-Controlled Key
HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A