CVE-2026-114362

MEDIUM 6.3

HarnessRouter Targets Test Endpoint app.py server-side request forgery

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.

CWE	CWE-918
Vendor	n/a
Product	harnessrouter
Published	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for n/a harnessrouter

Be the first to know when new medium vulnerabilities affecting n/a harnessrouter are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / HarnessRouter

0.31.0 0.31.1 0.31.2 0.31.3 0.31.4 0.31.5 0.31.6 0.31.7 0.31.8 0.31.9 0.31.10 0.31.11 0.31.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/424709 vuldb.com: https://vuldb.com/vuln/424709/cti vuldb.com: https://vuldb.com/cve/CVE-2026-114362 vuldb.com: https://vuldb.com/submit/1019387 github.com: https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-c5g7-c47h-f6c3 github.com: https://github.com/HarnessRouter/harnessrouter/pull/429 github.com: https://github.com/HarnessRouter/harnessrouter/commit/1c4b1fc1f89737dabd089ac1d1c174a57f764e28 github.com: https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.13 github.com: https://github.com/HarnessRouter/harnessrouter/

Credits

🔍 mikannse (VulDB User)