CVE-2026-114362: HarnessRouter Targets Test Endpoint app.py server-side request forgery
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument baseurl can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HarnessRouterto a version that resolves this vulnerability.Fixed in 0.31.13Patch 1c4b1fc1f89737dabd089ac1d1c174a57f764e28
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be performed remotely, but the CVSS vector indicates low privileges are required. An attacker must be able to manipulate the base_url argument used by the Targets Test Endpoint.
Which deployments should be treated as affected?
HarnessRouter versions up to and including 0.31.12 are affected where the Targets Test Endpoint in gateway/app.py is present and reachable by a user able to supply base_url. The available data does not state whether this endpoint is enabled or exposed in a default configuration.
What should be done if the affected version is in use?
Upgrade HarnessRouter to version 0.31.13. The fix is identified as patch 1c4b1fc1f89737dabd089ac1d1c174a57f764e28.