CVE-2026-114362

EUVD-2026-107502

21.10.2026, 20:17

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.

SSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-918 - Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

https://github.com/HarnessRouter/harnessrouter/

https://github.com/HarnessRouter/harnessrouter/commit/1c4b1fc1f89737dabd089ac1d1c174a57f764e28

https://github.com/HarnessRouter/harnessrouter/pull/429

https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.13

https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-c5g7-c47h-f6c3

https://vuldb.com/cve/CVE-2026-114362

https://vuldb.com/submit/1019387

https://vuldb.com/vuln/424709

https://vuldb.com/vuln/424709/cti