CVE-2026-54146— OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

Quick assessment

Affected

tinyhumansai openhuman

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

OpenHuman 是一个开源的智能体（agent）框架，提供桌面应用程序和 Rust 库两种形式。在 macOS 平台上，从版本 0.53.15 到 0.57.5（不含）之间，Tauri 桌面进程中的模块会在进程环境变量中发布每次启动时生成的承载式凭证（bearer credential），尽管核心服务现已作为进程内任务运行。同一用户下运行的其他进程可通过 macOS 的进程检查接口读取该环境变量，从而获取该令牌以及本地主机和端口信息，并以此令牌身份向核心的 JSON-RPC 服务进行认证，获得与桌面前端同

CVSS 8.8 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1055 · Process Injection

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)

Source: CVE Program / CVE List V5

Vulnerability Description

OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, core_process.rs in the Tauri desktop process publishes the per-launch OPENHUMAN_CORE_TOKEN bearer credential in its process environment even though the core now runs as an in-process task. Another process running as the same user can read that environment through the macOS KERN_PROCARGS2 process-inspection interface, recover the token together with the local host and port, and authenticate to the core JSON-RPC service with the authority of the desktop frontend. The attacker can read agent memory and integrated-account data, invoke privileged actions, change configuration, and stop or disrupt services without root access, developer mode, or changes to System Integrity Protection. This issue affects Intel and Apple Silicon macOS systems. This issue is fixed in version 0.57.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

通过环境变量导致的信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
tinyhumansai	openhuman	>= 0.53.15, < 0.57.5	-

II. Public POCs for CVE-2026-54146

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-54146

请登录查看更多情报信息。

Other References for CVE-2026-54146 (4)

https://github.com/tinyhumansai/openhuman/pull/2709 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5 x_refsource_MISC
https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-wp8v-f9rw-qjxc x_refsource_CONFIRM
https://github.com/tinyhumansai/openhuman/commit/336d811ca0ca610b49e82c16a11259c7a4014f28 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-54146

Same Patch Batch · tinyhumansai · 2026-11-05 · 10 CVEs total

CVE-2026-54143	9.8 CRITICAL	OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs lead
CVE-2026-54141	9.0 CRITICAL	OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
CVE-2026-54145	8.8 HIGH	OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log
CVE-2026-54142	8.7 HIGH	OpenHuman: Indirect prompt injection via background email sync executes Composio actions w
CVE-2026-49393	8.4 HIGH	OpenHuman: Unauthenticated Socket.IO RPC bypass allows invoking protected OpenHuman core c
CVE-2026-54140	8.3 HIGH	OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent
CVE-2026-49407	7.7 HIGH	OpenHuman: Unauthenticated dictation WebSocket allows arbitrary audio streaming and unboun
CVE-2026-49405	6.2 MEDIUM	OpenHuman: Unauthenticated server-sent events endpoint leaks user-facing event data
CVE-2026-54144	6.1 MEDIUM	OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a u

IV. Related Vulnerabilities

Same product: openhuman

Same vendor: tinyhumansai

Same weakness: CWE-526