---
title: "CVE-2026-82533: DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API"
url: https://erroneo.us/security/cve/CVE-2026-82533/
description: "CVE-2026-82533 (@deepseek-ai/dsh-client-connection (npm)): DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-09-08
date_modified: 2026-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-82533"
kev: false
cvss: 9.4
epss: 0.01238
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-82533: DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API

**Signal:** Critical and remotely reachable. No known exploitation yet, but it is network-reachable without credentials. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 1.2% , percentile 69: FIRST’s model estimates a 1.2% chance of exploitation activity in the next 30 days, higher than 69% of all scored CVEs (moderate). EPSS is a probability, not a verdict.
- Only applies if your dependency tree includes @deepseek-ai/dsh-client-connection (npm) < 0.1.2-alpha.1, fixed in 0.1.2-alpha.1 . Check your lockfile, including transitive dependencies.

## What it is

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

## Affected packages

- npm `@deepseek-ai/dsh-client-connection` < 0.1.2-alpha.1 → fixed: 0.1.2-alpha.1

## Affected products (CVE record)

- DeepSeek DeepSeek Harness: < 0.1.2-alpha.1

## Severity

- VulnCheck CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
- VulnCheck CVSS 3.1: 9.6 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`
- GitHub CVSS 4.0: 9.4 `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 1.24% probability of exploitation activity in the next 30 days; percentile 69.

## Sources

- [Release Notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1)
- [Patch Commit](https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27)
- [GitHub Advisory GHSA-8m2g-8cgm-3vcp](https://github.com/advisories/GHSA-8m2g-8cgm-3vcp)
- [CVE.org record CVE-2026-82533](https://www.cve.org/CVERecord?id=CVE-2026-82533)
- [NVD entry CVE-2026-82533](https://nvd.nist.gov/vuln/detail/CVE-2026-82533)
- [Researcher Blog](https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/)
- [vulncheck.com](https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing)

---
Source page: https://erroneo.us/security/cve/CVE-2026-82533/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt