CVE-2026-125330

The self-hosted unified API for agent harnesses, HarnessRouter , is vulnerable to an authorization bypass in versions 0.4.2 through 0.31.7. The root cause is that routes accepting a session ID or response ID validate the caller's organization but fail to enforce workspace scope for non-default wo...