CVE-2026-64650 AI SDK Codex Harness Tool Relay Authorization Bypass
Untrusted sandbox code can bypass authorization to invoke host tools, enabling secret access and cloud operations in AI SDK Codex Harness.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-64650?
CVE-2026-64650 is a medium-severity authentication bypass vulnerability in vercel @ai-sdk/harness-codex, published on 20 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The `@ai-sdk/harness-opencode` tool is an HarnessV1 adapter backed by @openai/codex-sdk, which drives the codex command line interface. Prior to version 1.0.29, the tool relay authorizes requests from any process whose command line contains an allowed helper script path (the Codex CLI shim). This allows untrusted code executing in the sandbox to invoke arbitrary host-exposed tools, including secret lookups, deployment operations, and cloud API calls without a corresponding model-authorized tool-call event. Exploitation requires a Linux environment (the vulnerable fallback checks `process.platform === 'linux'` and reads `/proc`); an active harness session with one or more host-provided tools; and untrusted code executing in the sandbox (e.g. a malicious dependency, build script, or lifecycle hook) The fix in version 1.0.29 removes the process-path authorization fallback entirely. Relay requests are now only accepted after exact, short-lived, one-time authorization matching the tool name and input from a bridge-observed model event. Some workarounds are available. Do not run the Codex harness on untrusted repositories or with untrusted dependencies, and/or limit host-exposed tools to non-sensitive operations when working with untrusted code.
Weakness: CWE-863
Which versions are affected by CVE-2026-64650?
How do I fix CVE-2026-64650?
No fix has been published for CVE-2026-64650 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-64650 being exploited?
There is no known exploitation of CVE-2026-64650 in the wild and no public exploit code.
Sources
Also known as GHSA-qw9h-448j-6rph.