Server-side request forgery in HarnessRouter Targets Test Endpoint
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
HarnessRouter up to 0.31.12 contains a server-side request forgery flaw (CWE-918) in the Targets Test Endpoint component, in the file gateway/app.py. Manipulating the base_url argument can make the server send requests to destinations chosen by the attacker. A remote attacker with low privileges can exploit this without user interaction.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HarnessRouter | 0.31.0; 0.31.1; 0.31.2; 0.31.3; 0.31.4; 0.31.5; 0.31.6; 0.31.7; 0.31.8; 0.31.9; 0.31.10; 0.31.11; 0.31.12 | 0.31.13 | Patch available | CNA |
- HarnessRouter Vendor— Affected 0.31.0; 0.31.1; 0.31.2; 0.31.3; 0.31.4; 0.31.5; 0.31.6; 0.31.7; 0.31.8; 0.31.9; 0.31.10; 0.31.11; 0.31.12 Fixed in 0.31.13 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:harnessrouter:harnessrouter:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:h:harnessrouter:harnessrouter:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
Upgrade HarnessRouter to version 0.31.13, which fixes the issue with the patch 1c4b1fc.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA HarnessRouter Fixed in 0.31.13
Timeline
- 2026-10-21 Threatist record created from CVE-2026-114362
- 2026-10-21 Alias added: GHSA-m79r-m5x7-m977
- 2026-10-28 CISA SSVC decision points changed
References
Patch 3
Sources
- CVE-2026-114362 · CVE Program
- CVE-2026-114362 · NVD
- FIRST EPSS
- GHSA-m79r-m5x7-m977 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences