Improper Authorization Vulnerability in HarnessRouter Identity Mode
CVE-2026-114361

6.3MEDIUM

Key Information:

Vendor

Harness

Status
Harnessrouter
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114361?

A vulnerability in the Identity Mode of HarnessRouter was found where improper authorization occurs due to manipulation of the arguments X-Harness-Org and X-Harness-Member in the gateway/app.py file. This issue enables remote attacks, allowing unauthorized access to sensitive functionalities. Although the exploit complexity is rated high, upgrading to version 0.31.11 provides a resolution with the applied patch identified as 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. Users are strongly advised to update their systems to prevent potential attacks.

Affected Version(s)

HarnessRouter 0.31.0

HarnessRouter 0.31.1

HarnessRouter 0.31.2

References

https://vuldb.com/vuln/424708
vdb-entrytechnical-description
https://vuldb.com/vuln/424708/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-114361
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mikannse (VulDB User)
.