{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-82533",
    "name": "CVE-2026-82533",
    "vendor": "DeepSeek Harness",
    "description": "OX Security researchers Nir Zadok and Moshe Siman Tov Bustan found an authentication bypass in the local agent-control HTTP API of DeepSeek Harness (dsh), which listens on 127.0.0.1:3080. Its isTrustedApiRequest check trusted the client-supplied Host header and never checked the real TCP peer address. The OS sandbox (bubblewrap, Landlock or Seatbelt) limited file writes but left loopback networking open, and Bash tool calls needed no approval, so a process inside the sandbox could call its own control API, switch its session to danger-full-access and turn off approval prompts, on the default configuration. If the port was reachable through a tunnel, SSH forward or reverse proxy, a remote attacker with no credentials could create sessions, run arbitrary commands and export stored conversation transcripts. The fix shipped in 0.1.2-alpha.1 on 27 August 2026, and VulnCheck, as CNA, published CVE-2026-82533 (CVSS 4.0 9.4, CWE-807) on 8 September covering all earlier versions. Neither source includes a statement from DeepSeek.",
    "website": "https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": null,
    "configFiles": null,
    "category": "agent",
    "updatedAt": "2026-09-08",
    "risk": {
      "score": 94,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-82533",
      "aliases": [
        "ti-120"
      ],
      "title": "CVE-2026-82533: DeepSeek Harness's Unauthenticated Local Control API Let a Sandboxed Agent Turn Off Its Own Sandbox (CVSS 9.4)",
      "summary": "OX Security researchers Nir Zadok and Moshe Siman Tov Bustan found an authentication bypass in the local agent-control HTTP API of DeepSeek Harness (dsh), which listens on 127.0.0.1:3080. Its isTrustedApiRequest check trusted the client-supplied Host header and never checked the real TCP peer address. The OS sandbox (bubblewrap, Landlock or Seatbelt) limited file writes but left loopback networking open, and Bash tool calls needed no approval, so a process inside the sandbox could call its own control API, switch its session to danger-full-access and turn off approval prompts, on the default configuration. If the port was reachable through a tunnel, SSH forward or reverse proxy, a remote attacker with no credentials could create sessions, run arbitrary commands and export stored conversation transcripts. The fix shipped in 0.1.2-alpha.1 on 27 August 2026, and VulnCheck, as CNA, published CVE-2026-82533 (CVSS 4.0 9.4, CWE-807) on 8 September covering all earlier versions. Neither source includes a statement from DeepSeek.",
      "severity": "critical",
      "cvss": {
        "score": 9.4,
        "vector": null,
        "version": null
      },
      "cwe": [
        "CWE-807"
      ],
      "attackType": [
        "Remote code execution",
        "Authentication bypass",
        "Sandbox escape"
      ],
      "componentType": "agent",
      "component": {
        "name": "DeepSeek Harness",
        "vendor": null,
        "package": null,
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "DeepSeek Harness before 0.1.2-alpha.1 (fixed 27 August 2026).",
          "fixed": "0.1.2-alpha.1"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-09-08",
      "modifiedAt": "2026-09-08",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/"
        },
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82533"
        }
      ],
      "mitigation": "Upgrade DeepSeek Harness to 0.1.2-alpha.1 or later on every machine where developers run it. Until each install is upgraded, never expose the control port (127.0.0.1:3080) through tunnels, SSH port forwards or reverse proxies, which makes the bug remotely exploitable with no credentials. On hosts that ran a vulnerable version with the port exposed, treat stored conversation transcripts as exfiltrated and rotate any secrets they contained. Do not treat an agent's OS sandbox alone as a boundary while loopback networking stays open to the agent.",
      "detectedByAnomity": true
    }
  }
}