# CVE-2026-54145: OpenHuman credential exposure through approval session identifier

Source: https://junglewise.ai/threats/cve-2026-54145-openhuman-is-an-open-source-agent-harness-available-as-a-desktop  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-54145 · Severity: high · CVSS 8.8 · Published 2026-11-05

OpenHuman is an open-source agent framework available as a desktop application and Rust library that uses JSON-RPC authentication tokens for remote access. In affected versions before 0.57.5, the JSON-RPC bearer token was inadvertently stored as a plain-text session identifier in approval records, debug logs, and on-disk databases, allowing anyone with access to these artifacts to recover the token and hijack the API session to access sensitive agent data or perform privileged operations.

Technologies: [Tinyhumans OpenHuman](https://junglewise.ai/threats/technologies/tinyhumans-openhuman). Vendors: [Tinyhumans](https://junglewise.ai/threats/vendors/tinyhumans).

## Quick answers

**Is CVE-2026-54145 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54145 being exploited in the wild.

**How severe is CVE-2026-54145?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** Tinyhumans OpenHuman before 0.57.5.

**Is there a fix for CVE-2026-54145?** Yes: fixed in 0.57.5. Until then: Rotate any JSON-RPC bearer tokens that were configured as stable credentials before upgrading; tokens used only within a single desktop session may be rotated once the upgrade to 0.57.5 is complete. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54145 attacked?** It is attacked with local access or from the adjacent network, in a software library.

**Am I affected by CVE-2026-54145?** Check whether you run Tinyhumans OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.57.5

Rotate any JSON-RPC bearer tokens that were configured as stable credentials before upgrading; tokens used only within a single desktop session may be rotated once the upgrade to 0.57.5 is complete.

## Technical details

The approval gate used the JSON-RPC bearer token directly as the session_id and persisted it in SQLite approval records, domain events, and audit logs without redaction, exposing the credential across multiple channels including desktop operation logs and RPC responses. An attacker with access to the approval database file, debug logs, or event bus subscribers can extract the stable or launch-specific bearer token and authenticate to the core RPC interface while it remains valid. The fix replaces bearer-based session identification with a per-launch UUID and includes a database migration to scrub legacy credential leaks.

## Affected products

- tinyhumans OpenHuman before 0.57.5

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe](https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe)
- [https://github.com/tinyhumansai/openhuman/pull/2952](https://github.com/tinyhumansai/openhuman/pull/2952)

## Related threats

- [OpenHuman prompt injection in background synchronization](https://junglewise.ai/threats/cve-2026-54142-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman remote code execution via unapproved Yuanbao channel messages](https://junglewise.ai/threats/cve-2026-54141-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)
- [OpenHuman prompt injection via MCP server tool descriptions](https://junglewise.ai/threats/cve-2026-54140-openhuman-is-an-open-source-agent-harness-available-as-a-desktop)