DeepSeek Harness local RPC accepted forged approval responses across user identities

The DeepSeek Harness local RPC service accepted session and tool-approval messages from a different operating-system user without binding decisions to the human authorizing the victim session.

The published local-boundary demonstration for CVE-2026-82033 showed that a reachable HTTP/WebSocket service could lead to execution of victim-user file and shell tools by supplying observed approval identifiers. It is not a remote Internet compromise.

The local boundary matters. The affected DeepSeek Harness process exposed session and approval channels through HTTP or WebSockets reachable by another operating-system principal. That other user could observe or supply identifiers that the harness treated as sufficient to accept a tool approval for the victim's session. Matching an approval ID shows which action is pending, not who authorized it. The risk is execution of the victim user's file or shell capabilities through the harness, rather than generic Internet-to-root exploitation. The distinct Host-header sandbox flaw in the same product has another entry point and should not be merged into this Case.

The local process boundary mattered more than the apparent human-approval dialog. If another operating-system user can reach the RPC service, obtain identifiers from its events and submit a response using those values, the service has checked correlation but not the identity of the approving principal. That may authorize victim-context shell or file actions without a real approval. The local-access prerequisite must not be described as an internet-exposed remote exploit, and the advisory alone does not establish use against deployed users.