CVE-2026-114361 Details
Description
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
An improper authorization vulnerability has been identified in HarnessRouter versions prior to 0.31.10. The issue arises in the Identity Mode component, specifically within the file gateway/app.py. The vulnerability allows for manipulation of the X-Harness-Org and X-Harness-Member headers, leading to unauthorized access. This vulnerability can be exploited remotely and is considered to have high complexity, making it difficult to exploit.
Upgrade to HarnessRouter version 0.31.11, which changes the default identity mode to 'enforce', ensuring that only verified tokens are accepted. For deployments that serve more than one organization, set HR_IDENTITY_MODE to 'enforce'.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HarnessRouter/harnessrouter/ | [email protected] | Vendor |
| https://github.com/HarnessRouter/harnessrouter/commit/48a26cdf9c4544d2c88d1a07f0777f063f1d753f | [email protected] | Source CodeVendor |
| https://github.com/HarnessRouter/harnessrouter/pull/426 | [email protected] | Issue TrackingVendor |
| https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.11 | [email protected] | Release NotesVendor |
| https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp | [email protected] | AdvisoryRemedyVendor |
| https://vuldb.com/cve/CVE-2026-114361 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1019383 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/424708 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/424708/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-266 | Incorrect Privilege Assignment | [email protected] |
| CWE-285 | Improper Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HarnessRouter | >= 0.4.2, <= 0.31.10 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |