CVE-2026-84114 Overview
CVE-2026-84114 is an improper authentication vulnerability in Cleo Harmony versions up to and including 5.8.1.10. The flaw resides in the LocalUserUtil.getNativeUserByAssertions function within the SAML Authentication component. Attackers can manipulate the Email argument to bypass authentication controls over the network. The vulnerability is classified under CWE-287: Improper Authentication. Public disclosure of the exploit technique has occurred, though no confirmed in-the-wild exploitation has been reported. Cleo addressed the issue in version 5.8.1.11.
Critical Impact
Authenticated attackers with low privileges can manipulate SAML assertion email arguments to impersonate other users, resulting in unauthorized access to confidentiality, integrity, and availability of the Harmony managed file transfer platform.
Affected Products
- Cleo Harmony versions up to 5.8.1.10
- Component: SAML Authentication (LocalUserUtil.getNativeUserByAssertions)
- Fixed version: Cleo Harmony 5.8.1.11
Discovery Timeline
- 2026-09-01 - CVE-2026-84114 published to the National Vulnerability Database
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-84114
Vulnerability Analysis
Cleo Harmony is a managed file transfer (MFT) platform used by enterprises to exchange business-critical data with trading partners. The vulnerability resides in the SAML Authentication handler, specifically the LocalUserUtil.getNativeUserByAssertions method. This routine maps incoming Security Assertion Markup Language (SAML) assertions to local Harmony user accounts.
The function trusts the Email argument from a SAML assertion without adequate validation. An attacker who can influence the email claim within a SAML assertion can cause Harmony to resolve to a different local user than the one intended by the identity provider. This constitutes an improper authentication weakness under CWE-287.
Because the attack vector is network-based and does not require user interaction, the flaw is remotely exploitable. Public exploit details have been disclosed through VulDB entry #397557.
Root Cause
The root cause is insufficient binding between the authenticated SAML subject and the local user record. The getNativeUserByAssertions function uses the email assertion as the lookup key without cryptographically verifying that the asserting identity provider intended that specific email-to-account mapping. This allows assertion manipulation to produce identity confusion.
Attack Vector
Exploitation requires network access to the Harmony SAML endpoint and a low-privilege authenticated context. The attacker crafts or influences a SAML assertion so that the Email field resolves to a different Harmony user account. The Harmony server then treats the request as originating from that alternate account, granting access to files, workflows, or transfer configurations belonging to the impersonated user.
No verified exploit code is publicly available for reproduction. See the VulDB advisory for additional technical context on the assertion manipulation technique.
Detection Methods for CVE-2026-84114
Indicators of Compromise
- SAML authentication log entries showing mismatches between the identity provider subject and the resolved Harmony local username.
- Multiple SAML sign-ins for the same session referencing different email claim values in rapid succession.
- Unexpected access to file transfer mailboxes or workflows by users who normally do not interact with them.
Detection Strategies
- Review Harmony authentication logs for invocations of LocalUserUtil.getNativeUserByAssertions that resolve email claims to accounts inconsistent with the asserting identity provider.
- Correlate SAML NameID values with the resolved local Harmony user account and alert on divergence.
- Baseline normal SAML claim structures per identity provider and flag deviations, particularly duplicate or unexpected email attributes.
Monitoring Recommendations
- Forward Harmony authentication and audit logs to a centralized SIEM or data lake for correlation with identity provider logs.
- Monitor for post-authentication activity that deviates from user role baselines, such as unusual file downloads or partner configuration changes.
- Enable alerting on privilege escalation patterns following any SAML sign-in event.
How to Mitigate CVE-2026-84114
Immediate Actions Required
- Upgrade Cleo Harmony to version 5.8.1.11 or later, as documented in the Cleo Harmony 5.8.1 Release Notes.
- Audit all Harmony local user accounts and remove or disable stale accounts that could be targets of assertion manipulation.
- Rotate SAML signing certificates and review identity provider trust configurations.
Patch Information
Cleo released Harmony 5.8.1.11 to remediate this vulnerability. Administrators should apply the update following the vendor's documented upgrade procedure. Review the Cleo Harmony release notes for prerequisites and version-specific notes.
Workarounds
- Restrict network access to the Harmony SAML authentication endpoint using firewall rules or a reverse proxy allowlist until the patch is applied.
- Enforce strict SAML assertion signing and require signed assertions from the identity provider.
- Temporarily disable SAML authentication and fall back to alternate authentication mechanisms if upgrade cannot occur immediately.
- Review and tighten the mapping between identity provider attributes and local Harmony user records.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
