Read the docs
TI-2026-85495 Aliases CVE-2026-54140

Prompt injection in OpenHuman through MCP tool descriptions

Priority LOW 37CWE-1427Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenHuman by tinyhumansai before 0.57.13 places tool names and descriptions from external MCP servers into the agent model context without neutralizing instructions. The flaw is an improper neutralization of LLM prompt input (CWE-1427). A malicious or compromised MCP server can return a poisoned description that runs on every agent turn and may direct the model to invoke other tools, disclose data or act without a user message. Only users who configure such a server are affected.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.

Why it matters now

EPSS 0.00554 46th percentileScored 2026-11-07
Fix Fixed openhuman (tinyhumansai): 0.57.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyhumansaiopenhumanbefore 0.57.130.57.13Patch availableCNA
  • openhuman Vendortinyhumansai Affected before 0.57.13 Fixed in 0.57.13 Patch available CNA

Remediation

Upgrade OpenHuman to 0.57.13, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA openhuman (tinyhumansai) Fixed in 0.57.13

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-54140
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
  • TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
  • TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
  • TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
  • TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
  • TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences