CVE-2026-114362
A flaw has been found in HarnessRouter up to 0.31.12
- Risk score
- 41/100
- CVSS
- 6.3 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
References
- https://github.com/HarnessRouter/harnessrouter/
- https://github.com/HarnessRouter/harnessrouter/commit/1c4b1fc1f89737dabd089ac1d1c174a57f764e28
- https://github.com/HarnessRouter/harnessrouter/pull/429
- https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.13
- https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-c5g7-c47h-f6c3
- https://vuldb.com/cve/CVE-2026-114362
- https://vuldb.com/submit/1019387
- https://vuldb.com/vuln/424709
- https://vuldb.com/vuln/424709/cti
Original description
A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.
Last activity 21 Oct 2026. Patch Forecast updates every hour.