Openharness EUVD-2026-23452

Exploitation requires the target OpenHarness deployment to expose AI agent sessions with enabled web_fetch or web_search tools via a network-accessible interface (web application, API, chatbot). Attacker must influence agent behavior through natural language prompts or API calls to trigger tool invocation with malicious URL parameters-no authentication required (PR:N) and no user interaction needed (UI:N) beyond normal interaction with the agent service. Successful exploitation depends on what internal HTTP services are network-reachable from the victim host: cloud environments with metadata endpoints at 169.254.169.254, internal admin panels on localhost ports, private network services in RFC1918 ranges, or Kubernetes service endpoints yield highest impact. Deployments isolated from sensitive internal networks or those running in restricted network namespaces without access to cloud metadata services face reduced risk. The Changed scope (S:C) confirms exploitation transcends the vulnerable application's own authorization boundary to access separate resources.

CVSS 8.3 (High) reflects the network attack vector (AV:N), no authentication required (PR:N), and changed scope (S:C) - accurate for SSRF enabling internal network reconnaissance and data exfiltration. The Low confidentiality/integrity/availability ratings (C:L/I:L/A:L) understate real-world impact: successful SSRF against cloud metadata services yields IAM credentials (high confidentiality), and requests to administrative endpoints can modify configurations (high integrity). EPSS score unavailable for this recent CVE. Not present in CISA KEV, indicating no confirmed widespread exploitation, though SSRF vulnerabilities are frequently exploited once discovered due to low attack complexity. No public POC reference provided, but SSRF exploitation is well-documented and trivial given the vulnerability description. SSVC assessment: Exploitation status is public (vulnerability disclosed with patch), automatable (no user interaction required per UI:N), technical impact is partial (initial access to internal services), but mission impact depends entirely on what internal services are exposed - cloud environments with metadata endpoints face critical risk. Priority depends on deployment context: high-priority patch for cloud-hosted instances with access to sensitive internal networks, moderate for isolated development environments. The network-accessible, no-authentication attack profile combined with Changed scope makes this a genuine priority despite the CVE's Low impact ratings, which fail to capture SSRF's lateral movement potential.

Remote attacker interacts with an OpenHarness-powered chatbot or AI agent, crafting prompts that cause the LLM to invoke web_fetch or web_search with attacker-controlled URLs targeting http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata endpoint). The agent executes the request from the server's network context, retrieves temporary IAM credentials, and returns them in the response or uses them for subsequent tool calls. Attacker escalates to full AWS account compromise using the exfiltrated credentials. Alternative scenario targets internal admin panels at http://localhost:8080/admin or private network services at http://192.168.1.10/config.json to map internal infrastructure and extract sensitive configuration data.