CVE-2026-114362 HarnessRouter CVE debrief

Who should care

Defenders responsible for HarnessRouter deployments should assess their current version and ensure it is upgraded to version 0.31.13 to mitigate the vulnerability. This involves reviewing the current version in use, verifying the upgrade, and implementing necessary updates promptly.

Why it matters

CVE-2026-114362 is a medium-severity vulnerability (CVSS Score of 5.3) in HarnessRouter up to version 0.31.12, allowing for server-side request forgery. Defenders should prioritize upgrading to version 0.31.13 and verify the current version in use to mitigate potential security risks.

• Potential security risks due to server-side request forgery
• Need for verification of current HarnessRouter version
• Priority on upgrading to version 0.31.13
• Potential impact on systems using HarnessRouter

Technical summary

The vulnerability (CVE-2026-114362) is a server-side request forgery issue in HarnessRouter up to version 0.31.12, located in the Targets Test Endpoint within the file gateway/app.py. The issue allows for manipulation of the argument base_url. Defenders should assess their current version and ensure it is upgraded to version 0.31.13, which includes a patch (1c4b1fc1f89737dabd089ac1d1c174a57f764e28) to mitigate the issue. This involves reviewing the current version in use, verifying the upgrade, and implementing necessary updates promptly. The vulnerability has a CVSS Score of 5.3, indicating a medium severity level.

Defensive priority

Defenders should prioritize upgrading to version 0.31.13 to address the vulnerability. This involves assessing the current version of HarnessRouter in use and verifying that the upgrade is applied. Given the medium severity of the vulnerability (CVSS Score of 5.3), it is essential to review and implement the necessary updates promptly.

Recommended defensive actions

• Upgrade HarnessRouter to version 0.31.13
• Verify the current version of HarnessRouter in use
• Review and implement the patch (1c4b1fc1f89737dabd089ac1d1c174a57f764e28)
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and associated sources indicate a server-side request forgery vulnerability in HarnessRouter up to version 0.31.12. The issue is addressed in version 0.31.13. However, specific details about exploitation or impact are not provided, suggesting a need for verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.