CVE-2026-40516 Overview
CVE-2026-40516 is a Server-Side Request Forgery (SSRF) vulnerability in HKUDS OpenHarness affecting commits prior to bd4df81. The flaw resides in the web_fetch and web_search tools, which fail to validate target addresses before issuing outbound HTTP requests. Attackers who can influence an agent session can direct these tools toward loopback, RFC1918, link-local, or other non-public addresses. This allows the agent to read response bodies from local development services, cloud metadata endpoints, admin panels, and other private HTTP services reachable from the victim host. The weakness is tracked as [CWE-918].
Critical Impact
Attackers can coerce the OpenHarness agent into reading internal HTTP services, including cloud instance metadata endpoints that may leak temporary credentials.
Affected Products
- HKUDS OpenHarness, all versions prior to commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
- Deployments exposing the web_fetch built-in tool to agent sessions
- Deployments exposing the web_search built-in tool to agent sessions
Discovery Timeline
- 2026-04-17 - CVE-2026-40516 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-40516
Vulnerability Analysis
OpenHarness exposes web_fetch and web_search as built-in agent tools that perform outbound HTTP requests on behalf of the model. Before the fix, neither tool enforced address-class restrictions on the destination URL. An agent session that processed attacker-controlled instructions, including prompt injection delivered through retrieved content, could invoke these tools with arbitrary internal targets.
The response body returned from the request flows back into the agent context. This enables exfiltration of internal HTTP responses through the same channel as legitimate web content. The risk is amplified in containerized and cloud deployments where the loopback interface and link-local addresses expose unauthenticated management services.
Root Cause
The root cause is missing validation of the request target address in the web tool implementations. The tools accepted any URL provided by the model without filtering loopback (127.0.0.0/8), RFC1918 ranges, link-local (169.254.0.0/16), or other non-public destinations. The fix introduced in commit bd4df81 adds web guards alongside hardened path rules, addressing prompt-injection-driven access patterns.
Attack Vector
Exploitation requires the ability to influence agent tool input, typically through indirect prompt injection in content retrieved by the agent or through a malicious user prompt. The attacker instructs the agent to call web_fetch against an internal URL such as http://169.254.169.254/latest/meta-data/ to retrieve cloud metadata, or against http://localhost:<port>/ to read local admin interfaces. The response body is returned to the agent and can be exfiltrated through subsequent tool calls or model output.
# Security patch in src/openharness/permissions/checker.py
# Source: https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae
# defence-in-depth measure against LLM-directed or prompt-injection
# driven access to credential files.
if file_path:
- for pattern in SENSITIVE_PATH_PATTERNS:
- if fnmatch.fnmatch(file_path, pattern):
- return PermissionDecision(
- allowed=False,
- reason=(
- f"Access denied: {file_path} is a sensitive credential path "
- f"(matched built-in pattern '{pattern}')"
- ),
- )
+ for candidate_path in _policy_match_paths(file_path):
+ for pattern in SENSITIVE_PATH_PATTERNS:
+ if fnmatch.fnmatch(candidate_path, pattern):
+ return PermissionDecision(
+ allowed=False,
+ reason=(
+ f"Access denied: {file_path} is a sensitive credential path "
+ f"(matched built-in pattern '{pattern}')"
+ ),
+ )
The companion change in src/openharness/engine/query.py normalizes tool inputs so permission checks apply consistently across tools using file_path, path, and directory-scoped roots such as glob and grep. See the GitHub commit for full details.
Detection Methods for CVE-2026-40516
Indicators of Compromise
- Outbound HTTP requests from the OpenHarness process to 127.0.0.0/8, 169.254.0.0/16, or RFC1918 addresses
- Agent tool invocations of web_fetch or web_search with URLs targeting localhost, metadata.google.internal, or 169.254.169.254
- Unexpected appearance of cloud instance metadata fields, IAM credentials, or internal admin panel content in agent transcripts
Detection Strategies
- Inspect OpenHarness logs for web_fetch and web_search tool calls and alert on any target URL whose resolved IP falls outside approved public ranges
- Correlate agent session transcripts with outbound network telemetry to identify SSRF attempts originating from prompt-injection patterns
- Deploy egress proxies that log and block agent traffic to internal address space, generating high-fidelity alerts on policy violations
Monitoring Recommendations
- Monitor host firewall and VPC flow logs for connections from the OpenHarness host to cloud metadata IPs
- Track tool-call frequency and target diversity per agent session to flag anomalous fan-out toward internal endpoints
- Audit access logs on internal admin services for the OpenHarness host as a source
How to Mitigate CVE-2026-40516
Immediate Actions Required
- Update OpenHarness to a build that includes commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae or later
- Restrict or disable the web_fetch and web_search tools in agent configurations until the patched build is deployed
- Rotate any credentials retrievable from cloud metadata services accessible to the OpenHarness host
Patch Information
The fix is delivered in GitHub Pull Request #92, merged as commit bd4df81. The change hardens path rules and adds web guards covering the SSRF-vulnerable tools. Additional analysis is available in the VulnCheck Security Advisory.
Workarounds
- Force outbound agent traffic through an egress proxy that denies requests to loopback, link-local, and RFC1918 destinations
- Configure cloud workloads to use IMDSv2 with a hop limit of 1 to prevent metadata access from containerized agents
- Remove web_fetch and web_search from the allowed tool list in agent permissions until upgrading
# Example egress proxy policy enforced at the OpenHarness host
iptables -A OUTPUT -m owner --uid-owner openharness -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openharness -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openharness -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openharness -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner openharness -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.