Quick answers
- Is CVE-2026-114361 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-114361 being exploited in the wild.
- How severe is CVE-2026-114361?
- Medium severity, with a CVSS score of 5.6, published 21 October 2026.
- Which products and versions are affected?
- HarnessRouter up to 0.31.10.
- Is there a fix for CVE-2026-114361?
- Yes: fixed in 0.31.11. Until then: Explicitly set the HR_IDENTITY_MODE environment variable to "enforce" to disable self-asserted identity and enforce proper identity verification instead of relying on the insecure default observe behavior. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-114361 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-114361?
- Check whether you run HarnessRouter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.31.11
Explicitly set the HR_IDENTITY_MODE environment variable to "enforce" to disable self-asserted identity and enforce proper identity verification instead of relying on the insecure default observe behavior.
Technical details
The gateway component in gateway/app.py improperly trusts self-asserted identity headers (X-Harness-Org/X-Harness-Member) when the HR_IDENTITY_MODE setting is not explicitly set to "off" or "observe". When HR_IDENTITY_MODE is unset, the gateway defaults to observe mode, which preserves these headers alongside an unverified bearer token, allowing an attacker to forge arbitrary identity claims. This is a remote authorization bypass requiring no authentication but depends on the gateway configuration.
Affected products
- HarnessRouter HarnessRouter up to 0.31.10
Timeline
- 2026-10-21: disclosed