Read the docs
TI-2026-85514 Aliases CVE-2026-49393

Socket.IO RPC in OpenHuman skips authentication checks

Priority LOW 36CWE-288Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

OpenHuman by tinyhumansai before 0.56.0 requires a bearer token for HTTP POST requests to /rpc but not for the Socket.IO rpc:request and chat:start handlers (CWE-306). A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests to protected controllers. Depending on the method, the attacker can read configuration or health data, start agent flows, alter local data, or stop and restart services.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the core server protects HTTP POST requests to /rpc with bearer middleware but exposes Socket.IO rpc:request and chat:start handlers without equivalent transport or handler-level authentication. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller path that rejects a missing bearer on /rpc. Depending on the selected method, the attacker can read configuration or health data, start agent flows, interact with integrated account APIs, alter local data, or stop and restart services. This issue is fixed in version 0.56.0.

Why it matters now

EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Fixed openhuman (tinyhumansai): 0.56.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyhumansaiopenhumanbefore 0.56.00.56.0Patch availableCNA
  • openhuman Vendortinyhumansai Affected before 0.56.0 Fixed in 0.56.0 Patch available CNA

Remediation

Upgrade OpenHuman to version 0.56.0, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA openhuman (tinyhumansai) Fixed in 0.56.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-49393
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
  • TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
  • TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
  • TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
  • TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
  • TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences