CVE-2026-82533: DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 1.2%, percentile 69: FIRST’s model estimates a 1.2% chance of exploitation activity in the next 30 days, higher than 69% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
• Only applies if your dependency tree includes @deepseek-ai/dsh-client-connection (npm) < 0.1.2-alpha.1, fixed in 0.1.2-alpha.1. Check your lockfile, including transitive dependencies.

What it is

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

From the GitHub advisory

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual TCP connection origin. Attackers can exploit this flaw to invoke privileged commands such as commands/execute with danger-full-access permissions, escalate session approval policies to unconfined execution, and retrieve all stored conversations without any credential or API key.

Weakness type: CWE-807.

Product: @deepseek-ai/dsh-client-connection (npm) · Assigned by: VulnCheck · Published: 2026-09-08

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: low
• Attack requirements: none
• Privileges required: none (no login)
• User interaction: passive

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 1.24% probability of exploitation activity in the next 30 days; percentile 69.

Timeline

• 2026-09-08 — CVE record published by VulnCheck
• 2026-09-08 — GitHub-reviewed advisory GHSA-8m2g-8cgm-3vcp published (critical)
• 2026-09-10 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

1. Release Notes github.com
2. Patch Commit github.com

Vulnerability records

1. GitHub Advisory GHSA-8m2g-8cgm-3vcp github.com
2. CVE.org record CVE-2026-82533 cve.org
3. NVD entry CVE-2026-82533 nvd.nist.gov

Other references from the CVE record and advisory

1. Researcher Blog ox.security
2. vulncheck.com vulncheck.com

Critical npm advisories · Today’s Security Digest