# CVE-2026-54145: OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

Status: published. Published: 2026-11-05. Updated: 2026-11-05.

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

## Remediation

No remediation reported in collected sources

## Affected products and versions

- tinyhumansai / openhuman: < 0.57.5 (affected). Source: CNA: GitHub_M

## Severity and prioritization

- CVSS 3.1: 8.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-200, CWE-312, CWE-532

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/tinyhumansai/openhuman/pull/2952 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5 (CNA: GitHub_M; x_refsource_MISC)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-54145; retrieved 2026-11-05; source updated 2026-11-05

Revision: afc4eacd2bd3d7c1417acfc73cb822ddc9af985151e1ab05f9ecd79c0e201db3

Canonical: https://y2.dev/cve/CVE-2026-54145

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.