CVE-2026-82533 is an authentication bypass vulnerability in DeepSeek Harness before version 0.1.2-alpha.1. The vulnerability arises because the local HTTP control-plane API validates only the client-supplied Host header rather than the actual TCP connection origin. Attackers can exploit this by supplying a spoofed Host header to gain full agent control, execute privileged commands with dangerous access permissions, escalate session approval policies to unconfined execution, and access all stored conversations without any authentication credentials or API keys. The CVSS 4.0 score is 9.4, indicating critical severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Successful exploitation results in full control over the DeepSeek Harness agent, including the ability to execute privileged commands, escalate session policies to unconfined execution, and access all stored conversations without authentication. This compromises confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is currently documented. Until a patch is available, restrict access to the local HTTP control-plane API to trusted networks and monitor for suspicious Host header manipulations.