Medium severity · published Oct 21, 2026
CVE-2026-114361
HarnessRouter Identity Mode app.py improper authorization
New
5.6
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. Upgrading to version 0.31.11 mitigates this issue. The patch is named 48a26cdf9c4544d2c88d1a07f0777f063f1d753f. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
HarnessRouter · Harnessrouter
0.31.0; 0.31.1; 0.31.2; 0.31.3; 0.31.4; 0.31.5; +5 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-114361
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-114361
github.com
https://github.com/HarnessRouter/harnessrouter/
github.com
https://github.com/HarnessRouter/harnessrouter/commit/48a26cdf9c4544d2c88d1a07f0777f063f1d753f
github.com
https://github.com/HarnessRouter/harnessrouter/pull/426
github.com
https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.11
github.com
https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp
vuldb.com
https://vuldb.com/cve/CVE-2026-114361
More from HarnessRouter
6.3
CVE-2026-114362
HarnessRouter Targets Test Endpoint app.py server-side request forgery