A significant security vulnerability has been identified in Cleo Harmony, a popular platform for managed file transfers and integrations, posing a serious threat to enterprise networks. Security experts have revealed that remote attackers can exploit this flaw to escalate privileges by manipulating the platform’s JWT refresh token mechanism.
Understanding the Vulnerability
Recognized as CVE-2026-84115 and assigned a high severity rating of 8.3 on the CVSS scale, this vulnerability impacts all Cleo Harmony versions up to 5.8.1.10. The immediate availability of a working exploit highlights the need for swift action from affected organizations.
The issue lies within the JWT Refresh Token Handler, specifically in a function related to the /api/connections endpoint. The core of the problem is the mishandling of the Bearer token in HTTP authorization headers, which can be crafted by attackers to gain unauthorized elevated permissions.
Implications of the Security Flaw
This vulnerability is categorized under CWE-269, indicating improper privilege management. The remote exploitability of this flaw is particularly concerning, as attackers can leverage manipulated HTTP requests over a network without requiring local access or valid credentials.
With a public proof-of-concept available, attackers could easily search for vulnerable Cleo Harmony instances to escalate privileges, potentially gaining administrative control over the platform. This control could expose sensitive data and allow manipulation of integration workflows connected to other business systems.
Preventive Measures and Recommendations
Cleo has released version 5.8.1.11 to address this issue by correcting the JWT Refresh Token Handler’s privilege management logic. Organizations using versions up to 5.8.1.10 should prioritize this patch to mitigate the risk of exploitation.
For those unable to update immediately, interim measures include implementing strict input validation on API requests, deploying Web Application Firewall (WAF) rules to detect and block suspicious Bearer token patterns, and monitoring access logs for unusual activity targeting the /api/connections endpoint.
Given Cleo’s track record of high-impact vulnerabilities, such as the CVE-2024-50623 file upload flaw, security teams are urged to treat this disclosure with utmost seriousness. Prompt patching remains the most effective strategy to prevent potential large-scale exploitation.
