What happened
A missing-authentication and incorrect-authorization defect (CWE-862/CWE-863) in the HarnessRouter console lets a remote, unauthenticated caller rewrite another organization's agent-provider connection to an endpoint the attacker controls, causing later prompts to be disclosed and attacker-controlled responses to be injected into tasks.
Why it matters
HarnessRouter is a unified API for running agent harnesses; an attacker who can point a victim org's provider connection at their own endpoint can read all prompts and feed manipulated responses back into that org's autonomous agents. CVSS 9.1 critical, no auth or interaction required.
Attack vector
In a non-self-hosted console, the server attaches its internal key to requests carrying an Authorization header before validating the bearer, while service-only routes trust that key and take the organization from the URL. A remote caller uses a made-up bearer to rewrite another organization's provider connection to an attacker-controlled endpoint.
Affected systems
HarnessRouter (harnessrouter) < 0.31.8
Mitigation
Upgrade to harnessrouter 0.31.8 (GitHub GHSA-p6cq-54cg-8mpv / commit 28609ec65ed671112d7e5418926bbd3cb3b25c00).