DeepSeek Harness CVE-2026-82533

Requires the DeepSeek Harness control-plane API (default 127.0.0.1:3080) to be running, and the victim operator to load attacker-controlled web content in a browser on the same host - the attack is a confused-deputy/DNS-rebinding vector (UI:P), not a direct network call. No credentials, API key, or authentication are needed once the operator's browser is weaponized, because the server trusts the client-supplied Host header instead of the TCP connection origin. Limiting factors: exploitation depends on operator browser interaction with a malicious page, applies only to versions before 0.1.2-alpha.1, and the fixed CLI additionally refuses --host 0.0.0.0 so a properly loopback-bound default reduces network reachability.

The vendor CVSS 4.0 base score is 9.4 (AV:N/AC:L/AT:N/PR:N/UI:P) with high confidentiality, integrity, and availability impact on both the vulnerable and subsequent systems, reflecting that a successful confused-deputy attack yields arbitrary bash execution on the operator's host. The critical limiting factor, correctly captured by UI:P, is that exploitation requires the victim operator to load attacker-controlled web content (DNS rebinding or malicious cross-site POST) while the harness is running - it is not a fire-and-forget internet-facing RCE. No EPSS score, KEV listing, or weaponized PoC is present in the provided data, so real-world exploitation pressure is currently unquantified; the primary corroboration is the upstream fixing commit and the VulnCheck advisory. Net: a genuinely high-severity design flaw for anyone running the affected alpha, but real-world risk is bounded by the browser-interaction prerequisite and the product's alpha/niche footprint, so it is a priority patch for actual users rather than a mass-exploitation threat.

An operator running DeepSeek Harness on 127.0.0.1:3080 visits an attacker-controlled web page, which uses DNS rebinding to point its domain at 127.0.0.1 and then issues requests to /api that the server trusts based on the spoofed Host header. The page invokes commands/execute with danger-full-access, escalating the session to unconfined execution and running arbitrary bash on the host, then exfiltrates all stored conversations - no credentials or API key required. The fixing commit and VulnCheck advisory describe the mechanics, but no packaged public exploit is identified at time of analysis.