CVE-2026-125331

Name of the Vulnerable Software and Affected Versions HarnessRouter versions prior to 0.31.8

Description In multi-organization deployments, a console not in self-hosted mode attaches the server's internal key to requests containing an Authorization header before validating the bearer. Certain service-only routes trust this key and extract the organization identity directly from the URL. This allows a remote, unauthenticated caller to use a fabricated bearer to rewrite another organization's provider connection to an attacker-controlled endpoint. Consequently, subsequent prompts may be disclosed, and attacker-controlled responses can influence tasks. The affected API endpoints include 'PUT /v1/orgs/{org}/connections/{name}', 'PUT /v1/orgs/{org}/policy/{backend}', and all routes under '/internal/*'.

Recommendations Update to version 0.31.8.