Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40516 OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private a… https://www.cve.org/CVERecord?id=CVE-2026-40516
Post summary
The tweet announces CVE-2026-40516 as a server‑side request forgery vulnerability in OpenHarness pre‑commit bd4df81, providing the type of flaw but no PoC, exploit, or patch information.
CVE-2026-40516 Server-Side Request Forgery in OpenHarness Web Fetch and Search Tools https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40516
Post summary
A new SSRF vulnerability, CVE‑2026‑40516, in OpenHarness Web Fetch and Search Tools is disclosed, but no PoC, exploit, or patch information is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hkuds | openharness | - | - | - |