Description
DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP control-plane API that allows attackers to gain full agent control by supplying a spoofed Host header, as the server validates only the client-supplied Host header value rather than the actual TCP connection origin.
Recommendation
Update the @deepseek-ai/dsh-client-connection package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.1.2-alpha.1
- Patched version(s): 0.1.2-alpha.1
References
Could your website be exposed too?
SmartScanner can check your website for DeepSeek Harness contains an authentication bypass vulnerability in local HTTP control-plane API and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header - CVE-2026-39411
- TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs - CVE-2026-47760
- Axios' HTTP adapter-streamed uploads bypass maxBodyLength when maxRedirects: 0 - CVE-2026-42034
- SunEditor: Critical XSS vulnerability - sanitizer bypass - CVE-2026-59167
You might also like:
See something that needs correcting? Let us knowUpdated October 07, 2026