CVE-2026-82533 json
DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
published 2mo ago modified 3d ago also EUVD-2026-73161 , GHSA-8m2g-8cgm-3vcp
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 69%
- public exploits
- 0
- none known
Summary
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.
Patch / fix
- npm @deepseek-ai/dsh-client-connection 0.1.2-alpha.1
- DeepSeek DeepSeek Harness 0.1.2-alpha.1
Is CVE-2026-82533 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2mo ago
Exploit prediction
1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- ox.security https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| CNA | 4.0 | 9.4 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @deepseek-ai/dsh-client-connection | <0.1.2-alpha.1 |
0.1.2-alpha.1 |
Affected products
- DeepSeek DeepSeek Harness
Classification
- Weakness
-
- CWE-807 Reliance on Untrusted Inputs in a Security Decision
References
-
github.com
/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27
patch, web
-
ox.security
/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
technical-description, exploit
-
github.com
/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
release-notes, web
-
vulncheck.com
/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-82533
advisory
-
github.com
/deepseek-ai/deepseek-harness
package
-
ox.security
/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape
web
Sources
- CVE List CVE-2026-82533
- GitHub Advisory GHSA-8m2g-8cgm-3vcp
- NVD CVE-2026-82533
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.