PT-2026-33464 · Unknown · Openharness

Published 2026-04-17 · Updated 2026-04-19 · CVE-2026-40516

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenHarness versions prior to commit bd4df81

Description An issue exists in the 'web fetch' and 'web search' tools where target addresses are not properly validated. This allows attackers to manipulate tool parameters to access private and localhost HTTP services. By influencing an agent session, attackers can invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.

Recommendations Update to the version containing commit bd4df81. As a temporary workaround, restrict the use of the 'web fetch' and 'web search' tools to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-40516

Affected Products

Openharness

References · 6

• 🔥 https://github.com/HKUDS/OpenHarness/pull/92 · Exploit
• https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40516 · Security Note
• https://vulncheck.com/advisories/openharness-ssrf-via-web-fetch-and-web-search · Note
• https://twitter.com/CVEnew/status/2045889729799876720 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2045240106336862624 · Twitter Post