Server-Side Request Forgery Vulnerability in HarnessRouter by Harness
CVE-2026-114362

5.3MEDIUM

Key Information:

Vendor

Harness

Status
Harnessrouter
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114362?

A vulnerability exists in HarnessRouter versions prior to 0.31.13, specifically affecting the Targets Test Endpoint component. An attacker can exploit this flaw by manipulating the 'base_url' argument within the 'gateway/app.py' file, potentially leading to server-side request forgery. This kind of attack allows remote access to sensitive information by leveraging the application's request capabilities. It is imperative for users to upgrade to version 0.31.13 or later, as this update includes a critical patch to mitigate the risk associated with this vulnerability.

Affected Version(s)

HarnessRouter 0.31.0

HarnessRouter 0.31.1

HarnessRouter 0.31.2

References

https://vuldb.com/vuln/424709
vdb-entrytechnical-description
https://vuldb.com/vuln/424709/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-114362
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mikannse (VulDB User)
.