CVE-2026-82533 json
DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
published 2026-09-08 2 mo ago modified 2026-11-08 26 h ago also EUVD-2026-73161 , GHSA-8m2g-8cgm-3vcp
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.
Patch / fix
- npm @deepseek-ai/dsh-client-connection 0.1.2-alpha.1
- DeepSeek DeepSeek Harness 0.1.2-alpha.1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 mo ago
Exploit prediction
1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- ox.security https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @deepseek-ai/dsh-client-connection | <0.1.2-alpha.1 |
0.1.2-alpha.1 |
Affected products
- DeepSeek DeepSeek Harness
Classification
- Weakness
-
- CWE-807 Reliance on Untrusted Inputs in a Security Decision
References
-
github.com
/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27
patch, web
-
ox.security
/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
technical-description, exploit
-
github.com
/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
release-notes, web
-
vulncheck.com
/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-82533
advisory
-
github.com
/deepseek-ai/deepseek-harness
package
-
ox.security
/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape
web
Sources
- CVE List CVE-2026-82533
- GitHub Advisory GHSA-8m2g-8cgm-3vcp
- NVD CVE-2026-82533
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.