Improper Isolation in Deepseek-AI's Deepseek-Harness Component
CVE-2026-101078

4.8MEDIUM

Key Information:

Vendor: Deepseek-ai
Status: Deepseek-harness
Vendor: CVE Published:; 28 September 2026

🔔 Create Deepseek-ai Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-101078?

A vulnerability exists in Deepseek-AI's Deepseek-Harness component, specifically within the Landlock Backend located in the profiles.ts file. This vulnerability allows for improper isolation or compartmentalization, which can be exploited locally. An attacker can manipulate the affected function to breach the intended security boundaries. Given that the exploit has been made public, it is imperative for users of the affected versions to apply the necessary patches promptly. The vendor was informed of this issue prior to its public disclosure but has not provided a response.

Affected Version(s)

deepseek-harness 0.1.7-rc.0

deepseek-harness 0.1.7-rc.1

deepseek-harness 0.1.7-rc.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-101078 - Proof of Concept