CVE-2026-54143 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-54143 requires immediate attention.

· 6 min read

Executive Summary

CVE-2026-54143 is a critical flaw in OpenHuman (desktop app and Rust library) that can let a remote attacker turn trusted agent activity into persistent shell cron jobs without human approval. The scheduler later runs those jobs as the OpenHuman runtime user, which can expose files, secrets, tokens, and other resources the agent can reach.

The issue is fixed in OpenHuman 0.57.13. While there is no known exploitation in the wild and it is not in CISA KEV, the severity is CVSS 9.8, so small teams should treat this as an urgent patch-and-audit item.

Immediate Action

  • Upgrade immediately to OpenHuman 0.57.13 or later on every desktop, server, and CI host.
  • Pause or isolate any deployment that receives messages from external channels until patched.
  • Review scheduled jobs created by the OpenHuman runtime user and remove anything unexpected.
  • Rotate secrets exposed to the OpenHuman runtime environment, including API keys, SSH keys, and cloud tokens.
  • Restrict external channel access to trusted senders only, or disable the channel temporarily if possible.
  • Check the vendor advisory and release notes: OpenHuman security advisory / release notes.

Affected Versions

  • openhuman<0.57.13 vulnerable
  • openhuman@0.57.13 and later safe
  • If you package OpenHuman as a desktop app or Rust library, any build containing versions before 0.57.13 is affected

Resolution Guide

Rust / Cargo

cargo update -p openhuman --precise 0.57.13
cargo tree | grep openhuman

JavaScript ecosystems if you wrap or bundle OpenHuman in a service package:

npm i openhuman@0.57.13
yarn add openhuman@0.57.13
pnpm add openhuman@0.57.13

Python wrappers or automation packages:

pip install --upgrade openhuman==0.57.13
pipx upgrade openhuman

Java build tools if OpenHuman is consumed through a JVM wrapper or service dependency:

./gradlew dependencies | grep -i openhuman
# TODO: pin the wrapper or artifact to 0.57.13 in build.gradle

mvn dependency:tree | grep -i openhuman
# TODO: set the dependency version to 0.57.13 in pom.xml

Linux package managers if your distro ships a package:

apt-cache policy openhuman
sudo apt-get update
sudo apt-get install --only-upgrade openhuman

yum list installed | grep -i openhuman
sudo yum update openhuman

Docker

docker pull openhuman/openhuman:0.57.13
# TODO: replace any :latest or pinned pre-0.57.13 tag in compose/k8s manifests

Config hardening

# TODO: disable external message ingestion until patched
OPENHUMAN_EXTERNAL_CHANNEL_ENABLED=false

# TODO: require human approval for any job creation path
OPENHUMAN_REQUIRE_APPROVAL_FOR_SCHEDULER=true

# TODO: run with least privilege and a dedicated non-login user
OPENHUMAN_RUN_AS=svc_openhuman

Minimal code hardening example for integrators who call the scheduler directly:

// Reject any job creation unless explicitly approved by a human/operator.
if !job_request.human_approved {
    return Err("scheduler job creation blocked: approval required");
}

// TODO: reject commands that begin with environment assignments
// Example: "VAR=value allowed_command" should be denied or normalized.
if starts_with_env_assignment(&job_request.command) {
    return Err("command rejected: leading environment assignments not allowed");
}

Detection & Verification

Check the installed version first:

openhuman --version
cargo tree | grep -i openhuman
pip show openhuman
npm ls openhuman
docker image ls | grep -i openhuman

Look for suspicious cron entries created by the OpenHuman runtime user:

crontab -u openhuman -l
sudo ls -la /var/spool/cron
sudo grep -R "openhuman\|agent\|scheduler" /etc/cron* /var/spool/cron 2>/dev/null

Search for unexpected helper redirection or environment-prefixed commands in logs and job definitions:

grep -R "^[A-Z_][A-Z0-9_]*=.*" /var/log/openhuman /opt/openhuman 2>/dev/null
grep -R "cron\|scheduler\|job created\|approved" /var/log/openhuman 2>/dev/null

Verify the fix after upgrading:

openhuman --version | grep 0.57.13
cargo tree | grep openhuman
crontab -u openhuman -l
# Confirm no new unauthorized jobs appear after normal agent activity

Risk and Impact

This flaw can convert a single malicious message into persistent command execution on the host running OpenHuman. Because the scheduled jobs run as the OpenHuman runtime user, an attacker may access local files, environment secrets, connected services, and any internal systems reachable from that account.

The demonstrated exploit requires a suitable helper executable already present on the host, which may limit some real-world attacks. However, the persistence and privilege scope still make this a high-risk issue for solo developers and small teams using OpenHuman with external channels enabled.

Keep reading