Member-only story
CVSS 9.4 on One Host Header: The DeepSeek Harness Bug Hides in Every .NET Agent Sidecar I’ve Audited
I read CVE-2026–82533 on Monday morning and immediately pulled up our own Program.cs, because the shape of the bug felt too familiar. CVSS 9.4 against the DeepSeek Harness: an unauthenticated localhost control API, gated only by the Host header, letting a sandboxed agent flip itself into danger-full-access. I kept reading, kept nodding, got to the end, opened our Semantic Kernel debug sidecar, and found the C# version of the same bug staring back at me.
Ours binds to 127.0.0.1:5173. Ours trusts Host: localhost as "proof" the caller is local. Ours will cheerfully flip the running agent out of read_only_tools into all_tools on request. It has lived like that for about eleven months. We shipped CVE-2026-82533 in C# before DeepSeek shipped it in Python, and we did it with Microsoft's own quickstart samples as the reference material.
Here is the thesis up front, so nobody has to scroll past three paragraphs of context to find it: localhost is not a security boundary when the attacker is the agent sitting next to you. The last decade of ASP.NET Core examples — the Microsoft Learn docs, every “run your Semantic Kernel sidecar on 127.0.0.1” blog post, every UseUrls("http://localhost:5000") starter -- quietly conflated "bound to loopback" with "safe to leave…
