Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    4 vulnerabilities by HarnessRouter

    CVE-2026-125331 (GCVE-0-2026-125331)

    Vulnerability from nvd – Published: 2026-11-10 18:38 – Updated: 2026-11-12 18:02
    VLAI
    Title
    HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer
    Summary
    HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-12 16:53 UTC
    CWE
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7886 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125331",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:53:22.134138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T18:02:28.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harnessrouter",
          "vendor": "HarnessRouter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server\u0027s internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization\u0027s provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:38:44.546Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/pull/418",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/pull/418"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8"
        }
      ],
      "source": {
        "advisory": "GHSA-p6cq-54cg-8mpv",
        "discovery": "UNKNOWN"
      },
      "title": "HarnessRouter: Service-only routes that write an organization\u0027s provider connections could be reached through a multi-tenant console with a made-up bearer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125331",
    "datePublished": "2026-11-10T18:38:44.546Z",
    "dateReserved": "2026-11-09T21:22:55.598Z",
    "dateUpdated": "2026-11-12T18:02:28.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125330 (GCVE-0-2026-125330)

    Vulnerability from nvd – Published: 2026-11-10 18:36 – Updated: 2026-11-14 03:00
    VLAI
    Title
    HarnessRouter: A workspace's API key could read and change sessions, files and responses of other workspaces in the same organization
    Summary
    HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-14 02:59 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7886 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    HarnessRouter harnessrouter Affected: >= 0.4.2, < 0.31.7
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-14T02:59:59.974685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-14T03:00:15.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harnessrouter",
          "vendor": "HarnessRouter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.2, \u003c 0.31.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller\u0027s organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:36:53.148Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9pjr-97x3-c4wv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9pjr-97x3-c4wv"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/pull/417",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/pull/417"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/commit/249c6cc9ab51a24a78f4e9809d356718f2ef74b1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/commit/249c6cc9ab51a24a78f4e9809d356718f2ef74b1"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.7"
        }
      ],
      "source": {
        "advisory": "GHSA-9pjr-97x3-c4wv",
        "discovery": "UNKNOWN"
      },
      "title": "HarnessRouter: A workspace\u0027s API key could read and change sessions, files and responses of other workspaces in the same organization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125330",
    "datePublished": "2026-11-10T18:36:53.148Z",
    "dateReserved": "2026-11-09T21:22:55.598Z",
    "dateUpdated": "2026-11-14T03:00:15.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125331 (GCVE-0-2026-125331)

    Vulnerability from cvelistv5 – Published: 2026-11-10 18:38 – Updated: 2026-11-12 18:02
    VLAI
    Title
    HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer
    Summary
    HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.
    Severity
    9.1 (Critical)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    SSVC
    Exploitation: none Automatable: yes Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-12 16:53 UTC
    CWE
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7886 records in the last 180 days details
    References
    Impacted products
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125331",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:53:22.134138Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T18:02:28.023Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harnessrouter",
          "vendor": "HarnessRouter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.31.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server\u0027s internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization\u0027s provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:38:44.546Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-p6cq-54cg-8mpv"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/pull/418",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/pull/418"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/commit/28609ec65ed671112d7e5418926bbd3cb3b25c00"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.8"
        }
      ],
      "source": {
        "advisory": "GHSA-p6cq-54cg-8mpv",
        "discovery": "UNKNOWN"
      },
      "title": "HarnessRouter: Service-only routes that write an organization\u0027s provider connections could be reached through a multi-tenant console with a made-up bearer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125331",
    "datePublished": "2026-11-10T18:38:44.546Z",
    "dateReserved": "2026-11-09T21:22:55.598Z",
    "dateUpdated": "2026-11-12T18:02:28.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-125330 (GCVE-0-2026-125330)

    Vulnerability from cvelistv5 – Published: 2026-11-10 18:36 – Updated: 2026-11-14 03:00
    VLAI
    Title
    HarnessRouter: A workspace's API key could read and change sessions, files and responses of other workspaces in the same organization
    Summary
    HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: none Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-11-14 02:59 UTC
    CWE
    • CWE-639 - Authorization Bypass Through User-Controlled Key
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7886 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    HarnessRouter harnessrouter Affected: >= 0.4.2, < 0.31.7
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-125330",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-14T02:59:59.974685Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-14T03:00:15.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "harnessrouter",
          "vendor": "HarnessRouter",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.2, \u003c 0.31.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller\u0027s organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-10T18:36:53.148Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9pjr-97x3-c4wv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9pjr-97x3-c4wv"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/pull/417",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/pull/417"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/commit/249c6cc9ab51a24a78f4e9809d356718f2ef74b1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/commit/249c6cc9ab51a24a78f4e9809d356718f2ef74b1"
        },
        {
          "name": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.7"
        }
      ],
      "source": {
        "advisory": "GHSA-9pjr-97x3-c4wv",
        "discovery": "UNKNOWN"
      },
      "title": "HarnessRouter: A workspace\u0027s API key could read and change sessions, files and responses of other workspaces in the same organization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-125330",
    "datePublished": "2026-11-10T18:36:53.148Z",
    "dateReserved": "2026-11-09T21:22:55.598Z",
    "dateUpdated": "2026-11-14T03:00:15.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}