GHSA-8m2g-8cgm-3vcpPublished
DeepSeek Harness < 0.1.2-alpha.1 Authentication Bypass via Host Header Spoofing
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-82533 · Microsoft / collected KEV context
cve-program · CVE-2026-82533
- https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
- https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
- https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27
- https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
euvd · EUVD-2026-73161
- https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
- https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
- https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27
- https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
nvd · CVE-2026-82533
- https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27
- https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
- https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape/
- https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
osv · GHSA-8m2g-8cgm-3vcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-82533
- https://github.com/deepseek-ai/deepseek-harness/commit/3e24087bfaeabe40b58ba2f7b936895b8f93fe27
- https://github.com/deepseek-ai/deepseek-harness
- https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v0.1.2-alpha.1
- https://www.ox.security/blog/cve-2026-82533-deepseek-harness-ai-agent-sandbox-escape
- https://www.vulncheck.com/advisories/deepseek-harness-alpha-1-authentication-bypass-via-host-header-spoofing
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.