CVE-2026-54145
OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.09% · top 100% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
- CWE-312: Cleartext Storage of Sensitive Information (opens in a new tab)All about CWE-312 and its CVEs
- CWE-532: Insertion of Sensitive Information into Log File (opens in a new tab)All about CWE-532 and its CVEs
Affected products
- affected < 0.57.5
References (4)
- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx (opens in a new tab)x_refsource_CONFIRM
- https://github.com/tinyhumansai/openhuman/pull/2952 (opens in a new tab)x_refsource_MISC
- https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe (opens in a new tab)x_refsource_MISC
- https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-54145)Record last updated .