CVE-2026-114361

MEDIUM 5.6

HarnessRouter Identity Mode app.py improper authorization

CVSS Score

5.6

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.

CWE	CWE-285 CWE-266
Vendor	n/a
Product	harnessrouter
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for n/a harnessrouter

Be the first to know when new medium vulnerabilities affecting n/a harnessrouter are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / HarnessRouter

0.31.0 0.31.1 0.31.2 0.31.3 0.31.4 0.31.5 0.31.6 0.31.7 0.31.8 0.31.9 0.31.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/424708 vuldb.com: https://vuldb.com/vuln/424708/cti vuldb.com: https://vuldb.com/cve/CVE-2026-114361 vuldb.com: https://vuldb.com/submit/1019383 github.com: https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp github.com: https://github.com/HarnessRouter/harnessrouter/pull/426 github.com: https://github.com/HarnessRouter/harnessrouter/commit/48a26cdf9c4544d2c88d1a07f0777f063f1d753f github.com: https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.11 github.com: https://github.com/HarnessRouter/harnessrouter/

Credits

🔍 mikannse (VulDB User)