CVE-2026-54145

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-54145

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54145.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-54145

Aliases

GHSA-ww8p-c82p-p8wx

Published

2026-11-05T16:33:32Z

Modified

2026-11-05T21:32:30Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

OpenHuman: Bearer token leaked via approval gate session_id (SQLite plaintext + debug log + RPC response)

Details

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200",
        "CWE-312",
        "CWE-532"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54145.json"
}

References

Affected packages

Git / github.com/tinyhumansai/openhuman

Affected ranges

Type

GIT

Repo

https://github.com/tinyhumansai/openhuman

Events

Introduced

Fixed

fbe0b46eb826bde354b5d961f36d80bc4f4223c4

Fixed

c5ff4a3516a9ad889b19a97eb1bba624908658fe

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.57.5"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "c5ff4a3516a9ad889b19a97eb1bba624908658fe"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.57.5",
            "range": [
                {
                    "fixed": "fbe0b46eb826bde354b5d961f36d80bc4f4223c4"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.50.3

v0.51.17

v0.51.18

v0.51.19

v0.51.2

v0.51.4

v0.51.5

v0.51.6

v0.51.8

v0.52.0

v0.52.12

v0.52.15

v0.52.16

v0.52.17

v0.52.18

v0.52.19

v0.52.2

v0.52.20

v0.52.26

v0.52.27

v0.52.28

v0.52.6

v0.52.7

v0.52.9

v0.53.0

v0.53.1

v0.53.10-staging

v0.53.11-staging

v0.53.12-staging

v0.53.13-staging

v0.53.14-staging

v0.53.15

v0.53.15-staging

v0.53.16

v0.53.17

v0.53.19-staging

v0.53.20-staging

v0.53.22

v0.53.25-staging

v0.53.26-staging

v0.53.27-staging

v0.53.28-staging

v0.53.29-staging

v0.53.3

v0.53.30-staging

v0.53.31-staging

v0.53.35

v0.53.35-staging

v0.53.36-staging

v0.53.38-staging

v0.53.4

v0.53.40

v0.53.43

v0.53.44-staging

v0.53.45-staging

v0.53.46-staging

v0.53.47-staging

v0.53.48-staging

v0.53.49-staging

v0.53.5-staging

v0.53.50-staging

v0.53.51-staging

v0.53.6-staging

v0.54.0

v0.54.22-staging

v0.55.1-staging

v0.56.0

v0.57.0

v0.57.1-staging

v0.57.2-staging

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54145.json"