Harnessrouter
Approved changes feed: RSS · Atom
cpe:2.3:h:harnessrouter:harnessrouter:*:*:*:*:*:*:*:*part: h version: * update: *
| Vendor | Harnessrouter (462567cf-e42a-502a-ab9c-4c3b2ef751de) |
|---|---|
| Product | Harnessrouter (f9c7e6ca-b1ed-593d-98dc-7a8b0bf65d07) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114361 |
vulnerable | 2026-11-03 10:15:53.487234 |
HarnessRouter Identity Mode app.py improper authorization
MEDIUM (5.6)
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
Published: 2026-10-21T19:00:18.743Z
Updated: 2026-10-23T15:09:14.205Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-114362 |
vulnerable | 2026-11-03 10:15:52.950621 |
HarnessRouter Targets Test Endpoint app.py server-side request forgery
MEDIUM (6.3)
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
Published: 2026-10-21T19:15:12.924Z
Updated: 2026-10-28T01:33:22.048Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.