{"schema":"threatline.record/2","record":{"id":"GHSA-qrr8-m92f-7vfp","aliases":["GHSA-qrr8-m92f-7vfp"],"summary":"The gateway trusted self-asserted organization headers by default when its identity mode was left unset","details":"### Summary\n\nThe gateway's identity mode (`HR_IDENTITY_MODE`) decides how it treats a request that carries the internal key beside a sign-in token. Left unset, it defaulted to `observe`, which keeps the `X-Harness-Org` and `X-Harness-Member` headers the request asserts even when the token does not verify. A console that is not in self-hosted mode attaches the internal key to every request carrying an `Authorization` header, so on a deployment serving several organizations that left the mode unset, a made-up token with a made-up organization header was answered as that organization.\n\n### Who is affected\n\nDeployments of this code that run the gateway outside the published image, for more than one organization, behind a console that is not in self-hosted mode, with `HR_IDENTITY_MODE` unset or set to `observe`, from 0.4.2 up to and including 0.31.10.\n\n**A default self-hosted install is not affected**: the image's entrypoint sets `off`, and its console pins the one organization and gives the key only to a signed-in session.\n\n### Patches\n\nFixed in **0.31.11**. Unset, or set to anything but `off` or `observe`, the mode is now `enforce`: the identity comes from the verified sign-in token, and a token that does not verify is refused. `observe` remains available only as an explicit choice.\n\n### Workarounds\n\nSet `HR_IDENTITY_MODE=enforce` on any gateway that serves more than one organization.\n\n### Credits\n\nReported privately by @mikannse. Our apologies for the time this report waited.\n","categories":["Unclassified"],"product":"harnessrouter/harnessrouter","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp","source_modified_at":"2026-10-07T19:55:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"harnessrouter/harnessrouter"},"range":">= 0.4.2, < 0.31.11"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp","source_modified_at":"2026-10-07T19:55:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"other","name":"harnessrouter/harnessrouter"},"version":"0.31.11"}],"cvss":7.4,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-07T19:55:26Z","modified_at":"2026-10-07T19:55:26Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/HarnessRouter/harnessrouter/security/advisories/GHSA-qrr8-m92f-7vfp","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-07T19:55:26Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-07T19:55:26Z","content_hash":"4b2d143bc4e512ce4bcb30798fbf22dcbbabaa938c223e1cf4619112eb1a7b55"}}