Read the docs
TI-2026-85128 Aliases CVE-2026-82033GHSA-h3m7-c9pq-7995

Missing authentication in DeepSeek RPC allows command execution

Priority LOW 37CWE-306Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

DeepSeek from 0 before 0.1.2-alpha.2 lacks authentication on its web profile HTTP and WebSocket RPC control plane (CWE-306). Any local process, including one running as a different OS user, can call unauthenticated session methods and run commands as the victim user through the agent's bash and filesystem tools. An attacker can also bypass human tool-approval checks and intercept live session traffic and logs.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication vulnerability in its web profile HTTP and WebSocket RPC control plane, allowing any local process, including those running as a different OS user, to reach unauthenticated session methods such as session.create and session.prompt. Attackers can invoke session.prompt to trigger the agent's bash and filesystem tools, achieve arbitrary command execution as the victim user using their configured model credentials, intercept live session traffic and logs over the event mux stream, and bypass human tool-approval checks via POST /api/respond by matching only rpcId, approvalId, and sessionId values broadcast over the ungated stream.

Why it matters now

EPSS 0.0022 12th percentileScored 2026-11-07
Fix Fixed deepseek-harness (deepseek-ai): 0.1.2-alpha.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
deepseek-aideepseek-harnessbefore 0.1.2-alpha.20.1.2-alpha.2Patch availableCNA
  • deepseek-harness Vendordeepseek-ai Affected before 0.1.2-alpha.2 Fixed in 0.1.2-alpha.2 Patch available CNA

Remediation

Update the affected deepseek-ai product to version 0.1.2-alpha.2, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA deepseek-harness (deepseek-ai) Fixed in 0.1.2-alpha.2

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-82033
  2. 2026-11-04 Alias added: GHSA-h3m7-c9pq-7995
  3. 2026-11-06 Priority changed: MEDIUM → LOW
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 1

  • TI-2026-70824 deepseek-ai deepseek-harness dsh-workflow-worker-thread agent behavioral workflow CVSS 4.0MEDIUM 5.1
  • TI-2026-65111 deepseek-ai deepseek-harness Landlock Backend profiles.ts isolation CVSS 4.0MEDIUM 4.8
  • TI-2026-83554 Path traversal in DeepInfer lets attackers create directories CVSS 4.0MEDIUM 6.3
  • TI-2026-65131 deepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox CVSS 4.0MEDIUM 5.3
  • TI-2026-70823 deepseek-ai deepseek-harness Sandbox spawn sandbox CVSS 4.0MEDIUM 4.8
  • TI-2026-65140 deepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences