CVE-2026-114361

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.

CVSS v3 5.6 MEDIUM
CVSS v2.0 5.1 MEDIUM

5.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

5.1^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:P

Exploitability : 4.9 / Impact : 6.4

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/HarnessRouter/harnessrouter/
https://github.com/HarnessRouter/harnessrouter/commit/48a26cdf9c4544d2c88d1a07f0777f063f1d753f
https://github.com/HarnessRouter/harnessrouter/pull/426
https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.11
https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp
https://vuldb.com/cve/CVE-2026-114361
https://vuldb.com/submit/1019383
https://vuldb.com/vuln/424708
https://vuldb.com/vuln/424708/cti

Configurations

No configuration.

History

21 Oct 2026, 19:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-21 19:17

Updated : 2026-10-23 15:17

NVD link : CVE-2026-114361

Mitre link : CVE-2026-114361

CVE.ORG link : CVE-2026-114361

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

CWE-285

Improper Authorization

{"id": "CVE-2026-114361", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114361", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-23T14:48:01.306015Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 5.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:h:harnessrouter:harnessrouter:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["Identity Mode"], "product": "HarnessRouter", "versions": [{"status": "affected", "version": "0.31.0"}, {"status": "affected", "version": "0.31.1"}, {"status": "affected", "version": "0.31.2"}, {"status": "affected", "version": "0.31.3"}, {"status": "affected", "version": "0.31.4"}, {"status": "affected", "version": "0.31.5"}, {"status": "affected", "version": "0.31.6"}, {"status": "affected", "version": "0.31.7"}, {"status": "affected", "version": "0.31.8"}, {"status": "affected", "version": "0.31.9"}, {"status": "affected", "version": "0.31.10"}, {"status": "unaffected", "version": "0.31.11"}]}]}], "published": "2026-10-21T19:17:00.977", "references": [{"url": "https://github.com/HarnessRouter/harnessrouter/", "source": "cna@vuldb.com"}, {"url": "https://github.com/HarnessRouter/harnessrouter/commit/48a26cdf9c4544d2c88d1a07f0777f063f1d753f", "source": "cna@vuldb.com"}, {"url": "https://github.com/HarnessRouter/harnessrouter/pull/426", "source": "cna@vuldb.com"}, {"url": "https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.11", "source": "cna@vuldb.com"}, {"url": "https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-114361", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/1019383", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/424708", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/424708/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded."}], "lastModified": "2026-10-23T15:17:25.923", "sourceIdentifier": "cna@vuldb.com"}