---
id: CVE-2026-54145
title: >-
  OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext
  + debug log + RPC response)
summary: >-
  OpenHuman is an open-source agent harness available as a desktop application
  and Rust library. In affected versions before 0.57.5, the approval gate uses
  the JSON-RPC bearer token as an approval session identifier. This exposes the
  crede…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-312
  - CWE-532
vendor: tinyhumansai
product: openhuman
affected:
  - openhuman < 0.57.5
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:33:32.114Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-54145'
references:
  - url: >-
      https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx
    label: >-
      https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx
  - url: 'https://github.com/tinyhumansai/openhuman/pull/2952'
    label: 'https://github.com/tinyhumansai/openhuman/pull/2952'
  - url: >-
      https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe
    label: >-
      https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe
  - url: 'https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5'
    label: 'https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.364Z'
---

## Overview

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

## Affected

- `openhuman < 0.57.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.