CVE-2026-40516
published 2026-04-17CVE-2026-40516: OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access…
PriorityP428medium6.3CVSS 3.1
AVLACLPRNUIRSCCHINAN
EPSS
0.18%
7.8th percentile
OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hkuds | openharness | < bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae | bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae |
| hkuds | openharness | < 2026-04-11 | 2026-04-11 |
CVSS provenance
nvdv3.16.3MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
nvdv4.07.8HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HKUDS OpenHarness HTTP Service web_fetch/web_search server-side request forgery (EUVD-2026-23452)
vuldb·2026-04-17·CVSS 7.8
CVE-2026-40516 [HIGH] HKUDS OpenHarness HTTP Service web_fetch/web_search server-side request forgery (EUVD-2026-23452)
A vulnerability categorized as critical has been discovered in HKUDS OpenHarness. This vulnerability affects the function web_fetch/web_search of the component HTTP Service. The manipulation results in server-side request forgery.
This vulnerability is identified as CVE-2026-40516. The attack can be executed remotely. There is not any exploit available.
It is best practice to apply a patch to resolve this issue.
GHSA
GHSA-785m-9q28-jp3m: OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to
ghsa_unreviewed·2026-04-17
CVE-2026-40516 [HIGH] CWE-918 GHSA-785m-9q28-jp3m: OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to
OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-17
Published