# DeepSeek Harness: any local process could drive the agent's tools

> The web interface of DeepSeek's agent harness accepted RPC calls from any local process, with no authentication at all.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-11-04
- **CVE:** CVE-2026-82033
- **CVSS:** 8.6
- **Affects:** DeepSeek Harness, @deepseek-ai/dsh (npm)
- **Research by:** Opr4
- **Primary source:** https://www.vulncheck.com/advisories/deepseek-harness-unauthenticated-rpc-command-execution
- **Page:** https://theinjection.dev/items/deepseek-harness-unauth-web-rpc-tool-execution/

DeepSeek Harness left its local web control plane unauthenticated, so any process on the machine could start a session, run the agent's bash and filesystem tools, and answer the human approval prompts itself.

## What happened

VulnCheck disclosed a missing-authentication flaw in DeepSeek Harness, DeepSeek AI's open-source agent harness, on 4 November 2026, crediting the researcher Opr4. The harness serves a web interface on the loopback address when started with the dsh web command.

## How it works

The HTTP and WebSocket RPC control plane behind that web interface checked no credentials. Any local process, including one running as a different operating system user, could call session methods such as session.create and session.prompt, then use the agent's bash and filesystem tools with the victim's configured model credentials. The same ungated event stream broadcast the rpcId, approvalId and sessionId values needed to answer a pending tool-approval prompt through POST /api/respond, and it exposed live session traffic and logs.

## Who is affected

Developers running the dsh web interface from a version VulnCheck lists as earlier than 0.1.2-alpha.2. Exposure requires an attacker to already run code on the same machine, such as a malicious dependency install script or a second account on a shared host. DeepSeek describes the project as a developer preview.

## What to do

Update DeepSeek Harness to the 0.1.2-alpha.2 release or later, which adds a host and origin fence plus browser token authentication to the web API. Rotate any model provider keys the harness held while an untrusted process could have reached it.

## Quick facts

- **Affected:** DeepSeek Harness before 0.1.2-alpha.2
- **Fixed in:** 0.1.2-alpha.2 (commit 3e24087)
- **CVE:** CVE-2026-82033
- **CVSS:** 8.6 high (VulnCheck)
- **Found by:** Opr4
- **Attack type:** Missing authentication on local RPC control plane

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/deepseek-harness-unauthenticated-rpc-command-execution)
2. [GitHub Advisory](https://github.com/advisories/GHSA-h3m7-c9pq-7995)
3. [Fix Commit](https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27)
4. [Fixed Release](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.2)