CVE-2026-54140 Details
Description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.
A vulnerability exists in OpenHuman versions prior to 0.57.13, where the application injects unvalidated and unsanitized tool descriptions from external MCP servers into the agent's model context. This flaw allows a malicious MCP server to embed instructions that are executed by the language model, potentially leading to unauthorized actions or data disclosure. The issue arises because the prompt-injection detection only scans user messages, not tool definitions from MCP servers.
Users can update to OpenHuman version 0.57.13 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyhumansai/openhuman/commit/00b8a669c6e6391a1be9f724bd9c8f755ee3c43e | [email protected] | Source CodeVendor |
| https://github.com/tinyhumansai/openhuman/pull/3215 | [email protected] | Source CodeVendor |
| https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13 | [email protected] | Release NotesVendor |
| https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-g6j9-89xv-v752 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
No weakness enumeration is available for this CVE.
Affected Products
| Product | Versions |
|---|---|
| tinyhumansai OpenHuman | < 0.57.13 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |