CVE-2026-82033High· 8.4▾ TwilightDeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a d…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.
deepseek-harness < 0.1.2-alpha.2deepseek-harness <= 3e24087bfaeabe40b58ba2f7b936895b8f93fe27Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108789Medium· 5.5A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2
CVE-2026-108788Medium· 5.3A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2
CVE-2026-101131Low· 3.3A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3
CVE-2026-101132Low· 3.1A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2
CVE-2026-101102Medium· 6.3A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7
CVE-2026-101078Medium· 6.3A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2