DeepSeek Harness missing authentication allows command execution via RPC

Same-computer programs can make this AI tool run commands.

Summary

DeepSeek Harness's web control interface lacks authentication, so any local process on the same machine can create sessions and run commands as the victim user. Versions before 0.1.2-alpha.2 and commit 3e24087 are affected.

Affected when

Attacker can run a local process on the same machine

What to do

Update to 0.1.2-alpha.2 or later.

Products and platforms

deepseek-harness

CVE IDs

CVE-2026-82033 (opens in a new tab)

Sources

Advisory: github.com (opens in a new tab)
Write-up: vulncheck.com (opens in a new tab)

Times

First published 2026-11-04 18:42 UTC

First seen 2026-11-09 16:00 UTC