CVE-2026-54145 Details
Description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.
A vulnerability exists in OpenHuman versions prior to 0.57.5, where the approval gate improperly uses the JSON-RPC bearer token as the approval session identifier. This mismanagement allows the token to be exposed through saved approval records, events, debug logs, and RPC responses, even during regular desktop use. An attacker who accesses these materials can retrieve the token and use it to interact with the core RPC interface, potentially accessing sensitive agent and integration data or performing privileged actions. The issue arises because stable tokens remain valid until rotated, and launch-specific tokens are active while the corresponding core instance is running.
Users can upgrade to OpenHuman version 0.57.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe | [email protected] | Source CodeVendor |
| https://github.com/tinyhumansai/openhuman/pull/2952 | [email protected] | Source CodeVendor |
| https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5 | [email protected] | Release NotesVendor |
| https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
| CWE-532 | Insertion of Sensitive Information into Log File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| tinyhumansai OpenHuman | < 0.57.5 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |