CVE-2026-49393: OpenHuman Socket.IO authentication bypass

CVE-2026-49393 · Severity: high · CVSS 8.4 · Published 2026-11-05

OpenHuman is an open-source agent harness desktop application and Rust library that enables automated workflows. Before version 0.56.0, the application protects HTTP API requests but fails to enforce authentication on Socket.IO handlers, allowing a local attacker to bypass security checks and execute privileged operations such as starting agent flows, reading configuration, or controlling services without credentials.

Technologies: Tinyhumansai OpenHuman. Vendors: Tinyhumansai.

Quick answers

Is CVE-2026-49393 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-49393 being exploited in the wild.
How severe is CVE-2026-49393?
High severity, with a CVSS score of 8.4, published 5 November 2026.
Which products and versions are affected?
Tinyhumansai OpenHuman before 0.56.0.
Is there a fix for CVE-2026-49393?
Yes: fixed in 0.56.0. Until then: Restrict network access to the Socket.IO endpoint at the firewall or system level to prevent local clients from connecting if the application is not fully trusted in the deployment environment. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49393 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-49393?
Check whether you run Tinyhumansai OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 0.56.0

Restrict network access to the Socket.IO endpoint at the firewall or system level to prevent local clients from connecting if the application is not fully trusted in the deployment environment.

Technical details

OpenHuman's core server applies bearer token authentication via middleware to HTTP POST requests at the /rpc endpoint, but the Socket.IO transport layer lacks equivalent handler-level authentication checks on rpc:request and chat:start events. A local unauthenticated client can connect to the Socket.IO namespace and dispatch requests through the same protected controller paths that reject unauthenticated HTTP requests. Depending on the invoked methods, an attacker gains read access to configuration and health data, can start agent workflows, interact with integrated APIs, modify local data, or stop and restart services.

Affected products

  • tinyhumansai OpenHuman before 0.56.0

Timeline

  • 2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.