CVE-2026-82533

DeepSeek Harness prior to 0.1.2-alpha.1 contains an authentication bypass in its local HTTP control-plane API. The root cause is that the server validates only the client-supplied Host header rather than the actual TCP connection origin, allowing a network attacker to spoof authentication. This p...