Authentication Vulnerability in HarnessRouter by Harness

CVE-2026-125331

What is CVE-2026-125331?

The HarnessRouter, a self-hosted unified API for managing agent harnesses, contains a vulnerability prior to version 0.31.8. In non-self-hosted mode, the server improperly attaches its internal key to requests that carry an Authorization header without validating the bearer token. This oversight allows an attacker, under multi-organization deployments, to exploit crafted bearer tokens to modify another organization's provider connection to redirect it to a malicious endpoint. This can lead to unauthorized access to sensitive information and influence subsequent tasks through attacker-controlled responses.

References