AI analysis
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass (CWE-807) in its local HTTP control-plane API: the server decides whether a request is trusted based only on the client-supplied Host header instead of verifying the actual origin of the TCP connection. An attacker who sends a request with a spoofed, accepted Host value is treated as a trusted local client and requires no credential or API key; the CVSS 4.0 vector's user-interaction flag (UI:P) suggests exploitation likely involves some user-triggered request reaching the API. With this access the attacker gains full agent control, including invoking privileged commands such as commands/execute with danger-full-access permissions, escalating the session approval policy to unconfined execution (so the AI agent can disable its own file sandbox without approval), and reading all stored conversations. Anyone running an affected version of DeepSeek Harness is exposed, with the local control-plane API as the attack surface. No public proof of concept or in-the-wild exploitation is known, the issue is not in CISA KEV, and EPSS estimates a roughly 0.4% chance of exploitation within 30 days (35th percentile), but the critical 9.4 CVSS 4.0 score warrants prompt patching.
What to do: Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later, which fixes the Host-header trust issue. Until patched, restrict which processes can reach the local control-plane API port (for example with local firewall rules) and review agent logs for unexpected commands/execute calls, approval-policy changes, or conversation reads, since successful abuse grants full agent control and exposes all stored conversations.
Affected
| DeepSeek Harness | all versions before 0.1.2-alpha.1 |
Estimated exposure
nichelikely thousands to low tens of thousands of local developer installations (early-stage 0.1.x tool; no public install counts) — No public install telemetry exists for this tool, so the estimate is scaled from its pre-1.0 alpha release maturity and its deployment pattern as a locally run AI agent harness rather than a mass-market product.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.