CVE-2026-108789

5.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-840, CWE-841

Impact

Remote authenticated attackers can manipulate workflow execution, causing partial data access, tampering, or disruption with public exploit code available. The attack requires low privileges and user interaction.

Root cause

Improper workflow management and behavioral workflow enforcement flaws in the dsh-workflow-worker-thread agent function.

Affected systems

deepseek-ai deepseek-harness up to 0.1.1-rc.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Fix & remediation

No fixed version is currently available as the vendor has not responded. Restrict network access to the deepseek-harness service and monitor or disable the dsh-workflow-worker-thread component until a patch is released.

shell

$ pip show deepseek-harness

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workflow-worker-thread. The manipulation leads to enforcement of behavioral workflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108789