CVE-2026-125331: HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer

Q: Which deployments are exposed to cross-organization impact?

Multi-organization deployments are exposed when the console is not running in self-hosted mode. A remote caller can target another organization's connection or policy routes because the organization is taken from the URL.

Q: What does an attacker need to exploit this issue?

The attacker only needs network access to the affected service and can send a request with a made-up Authorization bearer. No valid credentials or user interaction are required.

Q: What is the practical impact of a rewritten provider connection?

An attacker can point another organization's provider connection at an attacker-controlled endpoint. Later prompts may be disclosed to that endpoint, and attacker-controlled responses can influence tasks.

Q: What should be done if the deployment cannot be upgraded immediately?

The provided information identifies version 0.31.8 as the fix but does not specify a workaround. Restricting remote access to the affected service routes may reduce exposure until upgrading.

Q: How can operators determine whether they need to remediate?

Deployments running versions before 0.31.8 should be remediated. Exposure is specifically described for non-self-hosted consoles in multi-organization deployments.

Published Nov 10, 2026

Updated

HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/ routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.

Affected Software

1 affected component

HarnessRouter<0.31.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade HarnessRouter to a version that resolves this vulnerability.
Fixed in 0.31.8

Event History

Nov 10, 2026

CVE Published

via MITRE·06:38 PM

Data Sourced

via MITRE·06:38 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to cross-organization impact?

Multi-organization deployments are exposed when the console is not running in self-hosted mode. A remote caller can target another organization's connection or policy routes because the organization is taken from the URL.

What does an attacker need to exploit this issue?

The attacker only needs network access to the affected service and can send a request with a made-up Authorization bearer. No valid credentials or user interaction are required.

What is the practical impact of a rewritten provider connection?

An attacker can point another organization's provider connection at an attacker-controlled endpoint. Later prompts may be disclosed to that endpoint, and attacker-controlled responses can influence tasks.

What should be done if the deployment cannot be upgraded immediately?

The provided information identifies version 0.31.8 as the fix but does not specify a workaround. Restricting remote access to the affected service routes may reduce exposure until upgrading.

How can operators determine whether they need to remediate?

Deployments running versions before 0.31.8 should be remediated. Exposure is specifically described for non-self-hosted consoles in multi-organization deployments.

CVE-2026-125331: HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to cross-organization impact?

What does an attacker need to exploit this issue?

What is the practical impact of a rewritten provider connection?

What should be done if the deployment cannot be upgraded immediately?

How can operators determine whether they need to remediate?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to cross-organization impact?

What does an attacker need to exploit this issue?

What is the practical impact of a rewritten provider connection?

What should be done if the deployment cannot be upgraded immediately?

How can operators determine whether they need to remediate?