CVE-2026-125331

The HarnessRouter unified API is vulnerable to an authentication bypass in versions prior to 0.31.8 . A console not in self-hosted mode improperly attaches the server's internal key to requests containing an Authorization header before bearer validation. Service-only routes—including GET/PUT /v1/...

CVE-2026-125331 HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer

HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating...