Quick answers
- Is CVE-2026-54146 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54146 being exploited in the wild.
- How severe is CVE-2026-54146?
- High severity, with a CVSS score of 8.8, published 5 November 2026.
- Which products and versions are affected?
- Tinyhumansai OpenHuman 0.53.15 before 0.57.5 on macOS.
- Is there a fix for CVE-2026-54146?
- Yes: fixed in 0.57.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54146 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2026-54146?
- Check whether you run Tinyhumansai OpenHuman at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 0.57.5
Technical details
The Tauri desktop application's core_process.rs published the per-launch OPENHUMAN_CORE_TOKEN bearer credential as a process-global environment variable despite the core now running as an in-process task. An attacker process running as the same user can inspect the environment via macOS KERN_PROCARGS2 to recover the token, local host, and port, then authenticate to the core JSON-RPC service with the desktop frontend's authority. The vulnerability requires no root, developer mode, or SIP bypass; the fix moves the token from process environment to in-memory internal-only handoff.
Affected products
- tinyhumansai OpenHuman 0.53.15 before 0.57.5 on macOS
Timeline
- 2026-11-05: disclosed
- 2026-05-29: patched: Fix merged via PR #2709