CVE-2026-114361
Received
Received - Intake
Authorization Bypass in HarnessRouter via Header Manipulation
Vulnerability report for CVE-2026-114361, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: VulDB
Description
Description
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n/a | HarnessRouter | 0.31.0 |
| n/a | HarnessRouter | 0.31.1 |
| n/a | HarnessRouter | 0.31.2 |
| n/a | HarnessRouter | 0.31.3 |
| n/a | HarnessRouter | 0.31.4 |
| n/a | HarnessRouter | 0.31.5 |
| n/a | HarnessRouter | 0.31.6 |
| n/a | HarnessRouter | 0.31.7 |
| n/a | HarnessRouter | 0.31.8 |
| n/a | HarnessRouter | 0.31.9 |
| n/a | HarnessRouter | 0.31.10 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
