CVE-2026-114362

HarnessRouter Targets Test Endpoint app.py server-side request forgery

State: Published
Severity: 5.3 Medium
Published: Oct 21, 2026
Updated: Oct 28, 2026
Reserved: Oct 21, 2026

Description

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets Test Endpoint. Executing a manipulation of the argument base_url can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 0.31.13 will fix this issue. This patch is called 1c4b1fc1f89737dabd089ac1d1c174a57f764e28. It is suggested to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-918 Server-Side Request Forgery

Affected Products

Product	Versions
HarnessRoutern/a	0.31.0Affected 0.31.1Affected 0.31.2Affected 0.31.3Affected 0.31.4Affected 0.31.5Affected 0.31.6Affected 0.31.7Affected 0.31.8Affected 0.31.9Affected 0.31.10Affected 0.31.11Affected 0.31.12Affected 0.31.13Not affected

References

VDB-424709 | HarnessRouter Targets Test Endpoint app.py server-side request forgeryvdb-entrytechnical-description
VDB-424709 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-114362 | CVE Analysis and Reportthird-party-advisory
Submit #1019387 | harnessrouter >= 0.9.0, < 0.31.13 Server-Side Request Forgerythird-party-advisory
https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-c5g7-c47h-f6c3related
https://github.com/HarnessRouter/harnessrouter/pull/429issue-trackingpatch
https://github.com/HarnessRouter/harnessrouter/commit/1c4b1fc1f89737dabd089ac1d1c174a57f764e28patch
https://github.com/HarnessRouter/harnessrouter/releases/tag/v0.31.13patch
https://github.com/HarnessRouter/harnessrouter/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.