DeepSeek Harness accepted a spoofed loopback Host header as proof a request was local

What happened

The agent-control API authenticated requests by their Host header, so a client-supplied loopback value passed for a local caller. An attacker who reaches the port, including remotely where it is exposed, gains sandbox escape, can disable approval prompts and can read transcripts off the machine. NVD scores it CVSS 3.1 9.6. The dsh-v0.1.2-alpha.1 release requires every /api request to present a Host that is loopback or on a trusted list, adds one-time token authentication for network access and rejects --host 0.0.0.0.