# CVE-2026-49405: OpenHuman local server information disclosure via unauthenticated SSE endpoint

Source: https://junglewise.ai/threats/cve-2026-49405-openhuman-is-an-open-source-agent-harness-available-as-a-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-49405 · Severity: medium · CVSS 6.2 · Published 2026-11-05

OpenHuman is an open-source agent harness that runs locally on desktops and as a Rust library. Before version 0.56.0, its server-sent events endpoint exposed sensitive information including assistant responses, tool names, arguments, and outputs to unauthenticated attackers or malicious web pages opened by a user, because it failed to require proper authentication and allowed attackers to intercept other users' event streams by guessing predictable identifiers.

Technologies: [Tinyhumansai OpenHuman](https://junglewise.ai/threats/technologies/openhuman). Vendors: [Tinyhumansai](https://junglewise.ai/threats/vendors/tinyhumansai).

## Quick answers

**Is CVE-2026-49405 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49405 being exploited in the wild.

**How severe is CVE-2026-49405?** Medium severity, with a CVSS score of 6.2, published 5 November 2026.

**Which products and versions are affected?** Tinyhumansai OpenHuman before 0.56.0.

**Is there a fix for CVE-2026-49405?** Yes: fixed in 0.56.0. Until then: Restrict network access to the local OpenHuman server to trusted hosts only, or disable the server-sent events endpoint if not required, until upgrading to version 0.56.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-49405 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-49405?** Check whether you run Tinyhumansai OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.56.0

Restrict network access to the local OpenHuman server to trusted hosts only, or disable the server-sent events endpoint if not required, until upgrading to version 0.56.0.

## Technical details

The /events endpoint in OpenHuman's local server accepted a caller-supplied client_id query parameter without bearer token authentication and permitted cross-origin browser access, allowing unauthenticated clients or attacker-hosted web pages to subscribe to another client's event stream. The fixed system identifier made the proactive-message stream predictable, enabling attackers to enumerate or guess valid client IDs. The vulnerability exposes complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs. This is fixed in version 0.56.0 by implementing bearer token authentication and proper origin validation on the SSE endpoint.

## Affected products

- tinyhumansai OpenHuman before 0.56.0

## Timeline

- 2026-11-05: disclosed: CVE-2026-49405 published

## References

- [https://github.com/tinyhumansai/openhuman/commit/b1bbc53fceed7d1f0cff90cbb0a42f4ab8e153a1](https://github.com/tinyhumansai/openhuman/commit/b1bbc53fceed7d1f0cff90cbb0a42f4ab8e153a1)
- [https://github.com/tinyhumansai/openhuman/pull/2331](https://github.com/tinyhumansai/openhuman/pull/2331)

## Related threats

- [OpenHuman credential exposure in process environment on macOS](https://junglewise.ai/threats/cve-2026-54146-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman unauthorized persistent command execution via channel messages](https://junglewise.ai/threats/cve-2026-54143-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman Socket.IO authentication bypass](https://junglewise.ai/threats/cve-2026-49393-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [tinyhumansai OpenHuman OS command injection via allowlist bypass](https://junglewise.ai/threats/cve-2026-55743-tinyhumansai-openhuman-os-command-injection-via-allowlist-bypass)