Read the docs
TI-2026-85517 Aliases CVE-2026-54145

Bearer token leaked through approval gate session identifier in OpenHuman

Priority LOW 37CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

OpenHuman from tinyhumansai is affected before 0.57.5. The approval gate uses the JSON-RPC bearer token as an approval session identifier, so the credential is stored in persisted approval records, events, debug logs and RPC responses (CWE-312). An attacker who obtains these artifacts can recover the token and use the core RPC interface while the token remains valid, which can expose sensitive agent and integration data and permit privileged operations.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

Why it matters now

EPSS 0.00086 0th percentileScored 2026-11-07
Fix Fixed openhuman (tinyhumansai): 0.57.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyhumansaiopenhumanbefore 0.57.50.57.5Patch availableCNA
  • openhuman Vendortinyhumansai Affected before 0.57.5 Fixed in 0.57.5 Patch available CNA

Remediation

Update tinyhumansai openhuman to version 0.57.5, which fixes the flaw. Rotate any bearer tokens that may have been exposed, because stable tokens remain usable until rotated and launch-specific tokens remain usable while the corresponding core instance is active.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA openhuman (tinyhumansai) Fixed in 0.57.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-54145
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
  • TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
  • TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
  • TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
  • TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
  • TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences