Is CVE-2026-40516 actively exploited?

No active exploitation of CVE-2026-40516 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-40516 be exploited remotely?

Yes. CVE-2026-40516 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-40516?

CVE-2026-40516 has a CVSS score of 8.3 (HIGH).

HOME VULNERABILITIESCVE-2026-40516

HIGH

CVE-2026-40516

CWE-918Published: April 17, 2026· Updated: Apr 17, 2026

8.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:10.6th

Official Description

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.

NVD Source

Technical Analysis

CVE-2026-40516 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.