Deepseek - Deepseek Harness - CRITICAL - CVE-2026-82533. DeepSeek Harness, prior to version 0.1.2-alpha.1, exhibits a security flaw in its local HTTP control-plane API. This flaw allows attackers to bypass authentication by manipulating the Host header, leading to unauthorized control of the agent. The server improperly validates the Host header value provided by the client rather than the actual origin of the TCP connection. With this vulnerability, an attacker can execute privileged commands, escalate session approval policies to permit unrestricted execution, and access all stored conversations without requiring any credentials or API keys.