# CVE-2026-82533: DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

Status: published. Published: 2026-09-08. Updated: 2026-11-08.

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: VulnCheck) — https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27

## Affected products and versions

- DeepSeek / DeepSeek Harness (deepseek-ai/deepseek-harness): ≥ 0; < 0.1.2-alpha.1 (affected, custom). Source: CNA: VulnCheck

## Severity and prioritization

- CVSS 4.0: 9.4 (critical); CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H; source: CNA: VulnCheck

- CVSS 3.1: 9.6 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H; source: CNA: VulnCheck

- CISA KEV: No listing in collected sources

- EPSS: 1.24% as of 2026-11-08; percentile 69.29%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-807

## Exploit evidence

- exploit: https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ (CNA: VulnCheck)

## References

- https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/ (CNA: VulnCheck; technical-description, exploit)

- https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1 (CNA: VulnCheck; release-notes)

- https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27 (CNA: VulnCheck; patch)

- https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing (CNA: VulnCheck; third-party-advisory)

## Provenance

- CNA: VulnCheck: https://www.cve.org/CVERecord?id=CVE-2026-82533; retrieved 2026-11-08; source updated 2026-11-08

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-82533; retrieved 2026-11-08; source updated Not reported

Revision: b508adfc97b9bb56acab2f8db49da0c3fa29a90b1f32c059f5004ac5b96513ef

Canonical: https://y2.dev/cve/CVE-2026-82533

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.