Skip to content
OpenAdvisories

Vendor

HarnessRouter

2 known vulnerabilities.

Products

harnessrouter 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-125330

    HarnessRouter: A workspace's API key could read and change sessions, files and responses of other workspaces in the same organization

    HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. …

    HarnessRouter harnessrouter