CVE Watch10 de nov. de 2026

CVE-2026-125331

HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling.

CVSS

9.1

Crítica

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-862 · CWE-863

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an Authorization header before validating the bearer, while the service-only PUT and GET /v1/orgs/{org}/connections/{name}, PUT /v1/orgs/{org}/policy/{backend}, and /internal/* routes trust that key and take the organization from the URL. In a multi-organization deployment, a remote caller can use a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint, causing later prompts to be disclosed and attacker-controlled responses to influence tasks. This issue is fixed in version 0.31.8.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1253378.3 ALT

—

——0Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dispatches onImport(), onImportLoadForm(), onImportLoadColumnSampleForm(), onExport(), and onExportLoadForm() before those gated actions run, and the separately reachable download() action also lacks the granular export check. An authenticated backend user with a valid session and coarse access through $requiredPermissions, but without the configured import[permissions] or export[permissions], can use the import handlers to write or overwrite records and can use onExport() followed by download() to retrieve the complete dataset exposed by the export model. Controllers without granular permission keys are unaffected because userHasAccess() is intentionally default-permissive. This issue is fixed in version 1.2.14.2h CVE-2026-1208158.4 ALT

—

——0An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled. This may result in unintended access to stored data and credentials, unintended modification of data, and loss of availability of the server.2h CVE-2026-1208054.3 MÉD

—

——0In MongoDB Server, an authenticated user with insert privileges on a collection could craft a command with specially constructed encryption-related parameters to redirect internal Queryable Encryption metadata writes to metadata belonging to other encrypted collections within the same database. The server’s authorization layer validated only the user-facing target collection namespace, while subsequent internal writes derived from client-supplied parameters were performed with elevated internal privileges, bypassing the original caller’s permission scope. This could allow unauthorized writes into another collection’s Queryable Encryption metadata, potentially corrupting encrypted index state and compaction operations.2h CVE-2026-968457.8 ALT

—

——0Improper authorization in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.3h CVE-2026-961627.8 ALT

—

——0Incorrect authorization in Windows Clipboard Virtual Channel Extension allows an authorized attacker to elevate privileges locally.3h CVE-2026-961335.5 MÉD

—

——0Improper access control in Windows Graphics Kernel allows an authorized attacker to disclose information locally.3h