DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability in its local HTTP…

CVE-2026-82533 is an authentication bypass in DeepSeek Harness, a Python client library (pip install deepseek-harness) for DeepSeek V4-Pro/V4-Flash models. Versions before 0.1.2-alpha.1 expose a local HTTP control-plane API that validates the client-supplied Host header instead of the actual TCP connection origin (CWE-807). An attacker who can trick a user into visiting a malicious page while the harness is running locally can spoof the Host header via DNS rebinding or similar browser-mediated attacks, bypassing authentication entirely. This grants privileged command invocation, policy escalation to unrestricted execution, access to stored conversation histories, and full agent control. The fix is in commit 3e24087.

The vendor rates this CRITICAL at 9.6 — and the auth bypass mechanism is genuinely poor engineering. But the severity label wildly overstates the real-world risk. This is an alpha-stage developer tool with ~15,000 total PyPI downloads, listening on localhost only, requiring user interaction (the victim must click a link while the harness process is active). The blast radius caps at a single developer's AI agent session and chat history. There is no lateral movement, no credential harvesting, no domain-wide impact. The CVSS vector's S:C (Changed scope) is defensible in theory — the attacker crosses from browser context to local agent — but the practical population at risk is vanishingly small. This is a textbook case of CVSS inflation on a niche tool.

Why this verdict

• Localhost-only API: The control-plane listens on 127.0.0.1. Remote exploitation requires a browser-mediated pivot (DNS rebinding), adding significant friction and dependency on user interaction. This is not a directly internet-reachable service.
• Tiny installed base: ~15,000 total PyPI downloads for an alpha-stage library. The concurrent running population is likely in the low hundreds. Fewer than 0.001% of enterprise hosts will have this installed, let alone running.
• User interaction required: The CVSS vector correctly includes UI:R. The victim must visit an attacker-controlled page while the harness is actively running — a narrow timing window on a rare application.
• Role multiplier: DeepSeek Harness is a Python client library for AI model interaction. It is not deployed in any high-value infrastructure role (not an IdP, hypervisor, CI/CD component, backup agent, kernel-mode agent, network edge, or database). (a) *Low-value role (developer workstation)*: canonical deployment — chain succeeds, blast radius is one user's chat history and local agent session. (b) *Typical role*: same as (a) — there is no server-mode deployment. (c) *High-value role*: no realistic high-value deployment exists. Even if used in a CI/CD pipeline, it wraps AI chat calls and does not manage build artifacts, secrets, or deployment credentials. No floor override applies.
• No exploitation evidence: Zero PoCs, no KEV listing, EPSS at 35th percentile. The DNS rebinding prerequisite raises the bar above opportunistic scanning.

Why not higher?

Upgrading to HIGH would require either a meaningful high-value-role deployment pattern, active exploitation, or a directly internet-reachable attack surface. None of these conditions are met. The localhost-only listener, browser-mediated pivot, user interaction requirement, and ~15K-download alpha tool profile all compound to severely narrow the reachable population and blast radius.

Why not lower?

The underlying bug is a genuine authentication bypass (not just information disclosure), and the impact upon successful exploitation — unrestricted agent control and full conversation history access — is non-trivial for affected users. A developer's conversation history with an AI model could contain proprietary code, internal architecture details, or credentials pasted into prompts. LOW would understate the confidentiality impact for the small population actually at risk.

1. Stop running DeepSeek Harness if below 0.1.2-alpha.1 — The simplest mitigation: pip install --upgrade deepseek-harness>=0.1.2a1. Since this is a developer tool with no uptime SLA, upgrading or stopping the process eliminates the attack surface entirely. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window, though the trivial fix warrants immediate action.
2. Bind the control-plane API to a Unix socket instead of TCP if configurable — If the harness supports Unix domain socket configuration, switching from TCP localhost to a socket eliminates the DNS rebinding vector entirely since browsers cannot target Unix sockets.
3. Use browser DNS rebinding protections — Ensure developer workstations use DNS resolvers that enforce minimum TTLs and block rebinding patterns (e.g., Cloudflare Gateway, NextDNS, or enterprise DNS with rebinding protection enabled).

Run this on any developer workstation where DeepSeek Harness may be installed. No elevated privileges required. Invoke with: bash check_cve_2026_82533.sh

#!/usr/bin/env bash
# CVE-2026-82533 checker for DeepSeek Harness
# Checks installed version against the fixed version 0.1.2-alpha.1
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

PKG="deepseek-harness"
FIXED="0.1.2a1"  # PEP 440 normalized form of 0.1.2-alpha.1

# Check if package is installed
if ! pip show "$PKG" &>/dev/null; then
  echo "UNKNOWN — $PKG is not installed on this system."
  exit 2
fi

INSTALLED=$(pip show "$PKG" 2>/dev/null | grep -i '^Version:' | awk '{print $2}')

if [ -z "$INSTALLED" ]; then
  echo "UNKNOWN — could not determine installed version of $PKG."
  exit 2
fi

# Use Python to compare PEP 440 versions reliably
RESULT=$(python3 -c "
from packaging.version import Version
import sys
try:
    installed = Version('$INSTALLED')
    fixed = Version('$FIXED')
    if installed >= fixed:
        print('PATCHED')
    else:
        print('VULNERABLE')
except Exception as e:
    print(f'UNKNOWN — version parse error: {e}')
    sys.exit(2)
")

echo "$RESULT — $PKG version $INSTALLED installed (fixed in >= $FIXED)"

case "$RESULT" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. GHSA-8m2g-8cgm-3vcp — GitHub Security Advisory
2. NVD — CVE-2026-82533
3. PyPI — deepseek-harness
4. pepy.tech — deepseek-harness download stats
5. CWE-807 — Reliance on Untrusted Inputs in a Security Decision
6. CISA KEV Catalog