HarnessRouter: Cross-workspace access via workspace API key
Summary
HarnessRouter, a self-hosted unified API for agent harnesses, does not enforce the workspace scope of non-default workspace API keys on routes that accept a session or response ID. A key holder who learns a non-guessable ID from another workspace of the same organization can read sessions, conversation turns, files, traces and responses, overwrite files, cancel or delete sessions and publish share links. The attacker needs a valid workspace key and the identifier; organization boundaries are not crossed.
Affected
- HarnessRouter from 0.4.2 up to but excluding 0.31.7
Fixed in
- Version 0.31.7 (commit 249c6cc, PR #417)
Workaround
- No vendor workaround published.
- Until the upgrade: issue workspace API keys only to trusted holders, rotate keys that were shared across workspaces and restrict network access to the HarnessRouter endpoint.
Exploitation
- No exploitation in the wild known.
- No public proof of concept known.
- CISA KEV listing: Unknown.
Our recommendation
- Upgrade to the latest HarnessRouter release. Version 0.31.7 fixes this CVE, and later releases fix other vulnerabilities.
- Check whether several workspaces share one instance and who holds their API keys.
- Rotate workspace API keys after the upgrade if they may have been exposed.
- Monitor for unexpected access to sessions and files across workspaces.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125330 www.cve.org
- GitHub Security Advisory GHSA-9pjr-97x3-c4wv github.com
- HarnessRouter release v0.31.7 github.com
- Fix commit 249c6cc github.com
- Pull request #417 github.com
- VulDB entry 434202 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:13.
Original description (NVD)
HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. A key holder who learns a non-guessable identifier from another workspace in the same organization can read sessions, conversation turns, files, traces, and responses, overwrite files, cancel or delete sessions, and publish share links. The issue does not cross organization boundaries, and console users, organization keys, and Default Workspace keys intentionally retain organization-wide access. This issue is fixed in version 0.31.7.
NVD references (4)
- https://github.com/HarnessRouter/harnessrouter/commit/249c6cc9ab51a24a78f4e9809d356718f2ef74b1
- https://github.com/HarnessRouter/harnessrouter/pull/417
- https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.7
- https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-9pjr-97x3-c4wv
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.