Executive brief
OpenHarness, an AI agent framework, contains a security flaw in its web search and data retrieval tools. An attacker can trick the AI agent into accessing internal network services, cloud metadata, or local files that should be private. This could lead to the exposure of sensitive internal data or administrative interfaces that are not intended to be accessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in OpenHarness's built-in web_fetch and web_search tools due to insufficient validation of target URLs. The tools utilized the httpx library to fetch attacker-influenced endpoints, including following redirects, without restricting access to loopback (localhost), RFC1918 (private), or link-local addresses. An attacker can influence an agent session to invoke these tools against internal services or cloud metadata endpoints (e.g., IMDS) to retrieve sensitive response bodies. The vulnerability was addressed in commit bd4df81 by implementing a network guard that validates outbound targets and re-validates every redirect hop.
Affected products
- HKUDS OpenHarness before commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
Timeline
- 2026-04-09: disclosed: Initial pull request submitted by researcher
- 2026-04-11: patched: Fix merged into main branch via commit bd4df81
- 2026-04-17: advisory: CVE published and NVD entry created