CVE-2026-84115: Cleo Harmony Auth Bypass Vulnerability

CVE-2026-84115 Overview

CVE-2026-84115 is an improper privilege management vulnerability [CWE-266] affecting Cleo Harmony versions up to 5.8.1.10. The flaw resides in the JWT Refresh Token Handler exposed through the /api/connections endpoint. Attackers can manipulate the Bearer argument to obtain elevated privileges without authentication. The vulnerability is exploitable remotely across the network, and public exploit details have been published. Cleo addressed the issue in version 5.8.1.11.

Critical Impact
Remote, unauthenticated manipulation of JWT bearer tokens can lead to improper privilege assignment against the /api/connections API in Cleo Harmony managed file transfer deployments.

Affected Products

Cleo Harmony versions up to and including 5.8.1.10
JWT Refresh Token Handler component within the /api/connections API
Managed file transfer deployments running vulnerable Harmony builds

Discovery Timeline

2026-09-01 - CVE-2026-84115 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-84115

Vulnerability Analysis

Cleo Harmony is a managed file transfer platform used to move sensitive data between enterprises and trading partners. The /api/connections endpoint provides administrative visibility into configured connection profiles. The endpoint relies on a JSON Web Token (JWT) refresh flow to validate caller identity and scope. The JWT Refresh Token Handler fails to correctly bind privileges to a validated principal when processing the Bearer argument. As a result, a crafted request can cause the server to grant privileges the caller should not possess. Because the entry point is exposed over the network and does not require prior authentication, attackers can reach it directly from the internet where Harmony consoles are published.

Root Cause

The root cause is improper privilege management [CWE-266] in the refresh token code path. The handler trusts values conveyed in the Bearer argument to derive the caller's authorization context rather than deriving that context from a server-verified session. This design permits privilege assignment beyond what the token subject is entitled to.

Attack Vector

Exploitation occurs remotely over HTTP or HTTPS against the Harmony API surface. An attacker submits a manipulated request to /api/connections carrying a crafted Bearer value processed by the JWT Refresh Token Handler. Successful exploitation yields access to connection data or administrative functionality that would normally require higher privilege. Public exploit information is available, increasing the likelihood of opportunistic scanning against exposed Harmony instances. Refer to the Cleo Harmony 5.8.1 Release Notes and VulDB CVE-2026-84115 entry for additional technical context.

Detection Methods for CVE-2026-84115

Indicators of Compromise

Unexpected HTTP requests to /api/connections originating from external or non-administrative source addresses.
Requests presenting malformed, replayed, or unusually long Authorization: Bearer headers to the Harmony API.
Sudden appearance of new or modified connection profiles without a corresponding administrator change ticket.
Successful API responses to accounts that historically only performed file transfer operations.

Detection Strategies

Enable verbose access logging on Harmony web listeners and forward events to a central analytics platform.
Alert on /api/connections responses returning 2xx status codes to non-administrative principals or unrecognized user agents.
Baseline normal JWT refresh cadence per account and flag deviations such as high-frequency refreshes from single source IPs.

Monitoring Recommendations

Monitor Harmony administrative accounts for out-of-band token issuance and privilege changes.
Track network flows to the Harmony management interface and alert on connections from geographies or ASNs not used by administrators.
Correlate authentication events with subsequent configuration reads or writes to detect privilege drift.

How to Mitigate CVE-2026-84115

Immediate Actions Required

Upgrade Cleo Harmony to version 5.8.1.11 or later as specified by the vendor.
Restrict network exposure of the Harmony administrative interface to trusted management networks or VPN segments.
Rotate JWT signing keys and invalidate outstanding refresh tokens after patching to eliminate any tokens obtained pre-upgrade.
Review recent /api/connections activity and audit connection profiles for unauthorized modifications.

Patch Information

Cleo has released Harmony 5.8.1.11, which the vendor states is sufficient to remediate this issue. Details are documented in the Cleo Harmony 5.8.1 Release Notes. Upgrade all Harmony nodes, including secondary and disaster-recovery instances, then confirm the running build reports 5.8.1.11 or higher.

Workarounds

Place the Harmony API behind a reverse proxy or web application firewall that enforces strict authentication before requests reach /api/connections.
Apply IP allowlists limiting API access to known administrator ranges until the patch can be deployed.
Shorten refresh token lifetimes and reduce administrator session windows to minimize the exploitation window.

bash

# Configuration example: restrict /api/connections at an upstream reverse proxy (nginx)
location /api/connections {
    allow 10.10.20.0/24;   # administrator management subnet
    deny  all;
    proxy_pass https://harmony-backend;
}