Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49405— OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data

Quick assessment

Affected
tinyhumansai openhuman
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenHuman 是一个开源的智能体（agent）框架，提供桌面应用程序和 Rust 库两种形式。在 0.56.0 版本之前，其本地服务器在 端点暴露了服务器发送事件（Server-Sent Events, SSE）接口，且未实施 Bearer 令认证机制；该接口允许跨域浏览器访问，并仅依赖调用方提供的 从进程级事件总线中筛选 对象。未认证的本地客户端，或由受害者打开的由攻击者托管的网页，均可通过提供已知或猜测的标识符来订阅其他客户端的事件流；由于系统标识符固定，主动消息流具有可预测性。所暴露的事件可能包含完整的

CVSS 6.2 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49405

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
Source: CVE Program / CVE List V5
Vulnerability Description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0, the local server exposes the server-sent events endpoint at /events without bearer authentication, permits cross-origin browser access, and uses only a caller-supplied client_id to select WebChannelEvent objects from the process-wide event bus. An unauthenticated local client, or an attacker-hosted web page opened by the victim, can subscribe to another client's stream by supplying a known or guessed identifier; the fixed system identifier makes the proactive-message stream predictable. The exposed events can include complete assistant responses, streamed message content, tool names, tool arguments, and raw tool outputs intended for the local user interface. This issue is fixed in version 0.56.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tinyhumansai openhuman < 0.56.0 -

II. Public POCs for CVE-2026-49405

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49405

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49405 (1)

Vendor Pages for CVE-2026-49405 (1)

Other References for CVE-2026-49405 (1)

Same Patch Batch · tinyhumansai · 2026-11-05 · 10 CVEs total

CVE-2026-54143 9.8 CRITICAL OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs lead
CVE-2026-54141 9.0 CRITICAL OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
CVE-2026-54145 8.8 HIGH OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log
CVE-2026-54146 8.8 HIGH OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE
CVE-2026-54142 8.7 HIGH OpenHuman: Indirect prompt injection via background email sync executes Composio actions w
CVE-2026-49393 8.4 HIGH OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core c
CVE-2026-54140 8.3 HIGH OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent
CVE-2026-49407 7.7 HIGH OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unboun
CVE-2026-54144 6.1 MEDIUM OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a u

IV. Related Vulnerabilities

Same product: openhuman
Same vendor: tinyhumansai
Same weakness: CWE-200