Behavioral Workflow Vulnerability in deepseek-ai deepseek-harness
CVE-2026-108789

5.1MEDIUM

Key Information:

Vendor: Deepseek-ai
Status: Deepseek-harness
Vendor: CVE Published:; 12 October 2026

🔔 Create Deepseek-ai Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-108789?

A vulnerability exists in the deepseek-ai deepseek-harness software, specifically within the agent function of the dsh-workflow-worker-thread component. This flaw allows an attacker to manipulate the behavior of the workflow remotely. The exploit is actively available, and the potential for misuse has been acknowledged. Despite early notifications sent to the vendor regarding this vulnerability, no response or remedial actions have been taken.

Affected Version(s)

deepseek-harness 0.1.1-rc.0

deepseek-harness 0.1.1-rc.1

deepseek-harness 0.1.1-rc.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-108789 - Proof of Concept