Reference page — cumulative record through Saturday, October 3, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-82533

CVE-2026-82533CRITICAL

DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    9.4   .0120   67.2     —

AFFECTED
  Product           Versions     Fixed
  DeepSeek Harness  unspecified  —

TIMELINE
  Aug 29  Reserved by VulnCheck
  Sep 8   Published (CNA: VulnCheck)
  Sep 10  EXPLOIT PUBLISHED — CVE-2026-82533 (DeepSeek Harness). Public exploit reference added.

CWE-807 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Deferred

Description

DeepSeek Harness before 0.1.2-alpha.1 contains an authentication bypass vulnerability that grants unauthenticated access to its local HTTP agent-control API by accepting a client-supplied loopback Host header in place of validating the actual TCP connection origin. On the default configuration, a confined tool-executed process can reach the loopback API without any port exposure and use it to escape its own OS sandbox, escalate to unconfined execution, and disable the approval prompt. When the port is externally reachable via tunnel, SSH forward, or reverse proxy, a remote attacker can exploit the same flaw to create sessions, execute arbitrary commands, and exfiltrate stored conversation transcripts without credentials.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
August 29, 2026	Reserved	Reserved by VulnCheck
September 8, 2026	Published	Published (CNA: VulnCheck)
September 10, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-82533 (DeepSeek Harness). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
DeepSeek	DeepSeek Harness	—	—	—

Weaknesses

CWE-807

References (4)

Authoritative record: CVE-2026-82533 at cve.org

Vendors: deepseek

Weaknesses: CWE-807

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-82533 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Saturday, October 3, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.