CVE-2026-40516: OpenHarness SSRF via web_fetch and web_search
OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the webfetch and websearch tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40516?
The severity of CVE-2026-40516 has not been officially rated, but it is categorized as a server-side request forgery (SSRF) vulnerability which can lead to significant security risks.
How do I fix CVE-2026-40516?
To fix CVE-2026-40516, update to a version of OpenHarness that is beyond commit bd4df81, which addresses the SSRF vulnerability.
What are the potential impacts of CVE-2026-40516?
The potential impacts of CVE-2026-40516 include unauthorized access to private and localhost HTTP services, which can lead to data breaches and other malicious activity.
Which versions of OpenHarness are affected by CVE-2026-40516?
OpenHarness versions before commit bd4df81 are affected by CVE-2026-40516.
What is an SSRF vulnerability in the context of CVE-2026-40516?
In the context of CVE-2026-40516, an SSRF vulnerability allows attackers to send requests from the server to internal resources by manipulating parameters in web_fetch and web_search tools.