Is CVE-2026-116368 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116368 being exploited in the wild.

How severe is CVE-2026-116368?

High severity, with a CVSS score of 7.3, published 26 October 2026.

Which products and versions are affected?

DeepSeek Harness up to 0.2.0-rc.2.

Is there a fix for CVE-2026-116368?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-116368 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116368?

Check whether you run DeepSeek Harness at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116368: DeepSeek Harness improper authorization in browser auth

CVE-2026-116368 · Severity: high · CVSS 7.3 · Published 2026-10-26

DeepSeek Harness is a browser-based authentication component used in development tooling. A flaw in the browser authentication mechanism allows attackers to bypass authorization checks remotely, potentially granting unauthorized access to protected functionality or data without requiring valid credentials.

Technologies: DeepSeek Harness. Vendors: DeepSeek.

Quick answers

Is CVE-2026-116368 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116368 being exploited in the wild.
How severe is CVE-2026-116368?: High severity, with a CVSS score of 7.3, published 26 October 2026.
Which products and versions are affected?: DeepSeek Harness up to 0.2.0-rc.2.
Is there a fix for CVE-2026-116368?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-116368 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116368?: Check whether you run DeepSeek Harness at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the Browser Auth component (browser-auth.ts) of DeepSeek Harness and allows improper authorization through unknown processing logic. The issue is remotely exploitable and does not require authentication or user interaction, meaning an attacker can initiate the attack directly over the network.

Affected products

DeepSeek Harness up to 0.2.0-rc.2

Timeline

2026-10-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.