CVE-2026-125330

Name of the Vulnerable Software and Affected Versions HarnessRouter versions 0.4.2 through 0.31.6

Description Routes that accept a session ID or response ID validate only the caller's organization and fail to enforce the workspace scope for non-default workspace API keys. An attacker possessing a non-guessable identifier from another workspace within the same organization can perform unauthorized actions, including reading sessions, conversation turns, files, traces, and responses, as well as overwriting files, canceling or deleting sessions, and publishing share links. This issue is limited to the organization boundary; console users, organization keys, and Default Workspace keys maintain their intended organization-wide access.

Recommendations Update HarnessRouter to version 0.31.7.