Read the docs
TI-2026-85523 Aliases CVE-2026-54146

OpenHuman bearer token leak via process environment variable on macOS

Priority LOW 37CWE-526Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

OpenHuman from 0.53.15 before 0.57.5 on macOS stores its per-launch OPENHUMAN_CORE_TOKEN bearer token in the Tauri desktop process environment, though the core runs in-process. Another process running as the same user can read it via KERN_PROCARGS2, recover the token with the local host and port, and call the core JSON-RPC service with the desktop frontend's authority, reading agent memory and integrated-account data, invoking privileged actions and changing configuration without root. Affects Intel and Apple Silicon macOS systems. Weakness: CWE-526.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process environment even though the core now runs as an in-process task. Another process running as the same user can read that environment through the macOS KERN_PROCARGS2 process-inspection interface, recover the token together with the local host and port, and authenticate to the core JSON-RPC service with the authority of the desktop frontend. The attacker can read agent memory and integrated-account data, invoke privileged actions, change configuration, and stop or disrupt services without root access, developer mode, or changes to System Integrity Protection. This issue affects Intel and Apple Silicon macOS systems. This issue is fixed in version 0.57.5.

Why it matters now

EPSS 0.00213 11th percentileScored 2026-11-07
Fix Fixed openhuman (tinyhumansai): 0.57.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
tinyhumansaiopenhuman0.53.15 to before 0.57.50.57.5Patch availableCNA
  • openhuman Vendortinyhumansai Affected 0.53.15 to before 0.57.5 Fixed in 0.57.5 Patch available CNA

Remediation

Upgrade tinyhumansai OpenHuman to version 0.57.5, which fixes the issue. Affected versions are from 0.53.15 before 0.57.5.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA openhuman (tinyhumansai) Fixed in 0.57.5

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-54146
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-85521 Prompt injection in OpenHuman background sync runs Composio actions CVSS 3.1HIGH 8.7
  • TI-2026-75524 OpenHuman Telegram login callback lets attackers swap user sessions CVSS 3.1HIGH 8.1
  • TI-2026-85515 OpenHuman event stream endpoint leaks user-facing data without authentication CVSS 3.1MEDIUM 6.2
  • TI-2026-85522 OpenHuman lets channel messages create unapproved shell cron jobs CVSS 3.1CRITICAL 9.8
  • TI-2026-40241 OpenHuman desktop agent shell tool sandbox bypass leads to arbitrary command execution CVSS 4.0CRITICAL 9.4
  • TI-2026-85516 OpenHuman Yuanbao channel bypasses approval for node_exec commands CVSS 3.1CRITICAL 9.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences