Cleo Harmony Flaw Lets Remote Attackers Escalate Privileges via JWT Refresh Token

Key Takeaways

• A critical vulnerability (CVE-2026-84115) in Cleo Harmony, a managed file transfer platform, allows remote privilege escalation.
• The flaw, rated 8.3 (High) CVSS, impacts all versions up to 5.8.1.10 and is actively exploited by a public proof-of-concept.
• Attackers can manipulate JWT refresh tokens via the /api/connections endpoint to gain elevated permissions.
• Cleo has released a patch in version 5.8.1.11, which organizations should apply immediately.

A significant security flaw has been uncovered in Cleo Harmony, a widely utilized managed file transfer (MFT) and integration platform. This vulnerability enables remote attackers to elevate their privileges within enterprise networks by manipulating the software’s JSON Web Token (JWT) refresh token mechanism.

Designated as CVE-2026-84115 and assigned a CVSS score of 8.3 (High), this critical issue affects all Cleo Harmony builds up to and including version 5.8.1.10. The urgency for immediate remediation is heightened by the confirmed existence of a publicly available exploit, indicating a clear and present danger to vulnerable systems.

The root cause of the vulnerability lies within the JWT Refresh Token Handler component, specifically within an undefined function linked to the /api/connections endpoint. The core problem is an insufficient validation of the Bearer argument found in HTTP authorization headers. By crafting a malformed Bearer token, an attacker can deceive the application into granting unauthorized, elevated permissions during a session refresh.

Understanding the Cleo Harmony Vulnerability

Security experts classify this weakness under CWE-269, which denotes Improper Privilege Management. This categorization highlights Cleo Harmony’s failure to correctly enforce access controls and role-based boundaries when processing authentication token refresh requests.

The remote exploitability of this bug makes it particularly hazardous. As detailed in the VulDB vulnerability advisory, the attack can be executed entirely over a network using manipulated HTTP requests. This means attackers do not require local system access, physical proximity, or even valid initial credentials in some attack scenarios.

The combination of remote exploitability and a public proof-of-concept creates a realistic threat landscape. Defenders now face the possibility of opportunistic attackers actively scanning for exposed Cleo Harmony instances and attempting privilege escalation with minimal effort. A successful exploit could grant an attacker administrative control over the platform, potentially exposing sensitive file transfer data and allowing them to tamper with critical integration workflows that link Harmony to other vital business systems.

From a threat intelligence perspective, this flaw aligns with token manipulation tactics frequently observed in authentication bypass techniques within the MITRE ATT&CK framework. Attackers commonly intercept, forge, or replay malformed bearer tokens to bypass the intended refresh-token validation logic, thereby achieving persistent access or pivoting laterally if Harmony is integrated into other interconnected environments.

Cleo has already released a fix for this vulnerability in version 5.8.1.11, which addresses the underlying privilege management logic within the JWT Refresh Token Handler. Given the public availability of an exploit, organizations operating any version at or below 5.8.1.10 must prioritize this patch.

For organizations unable to upgrade immediately, temporary mitigation strategies include implementing stringent input validation on all API requests, deploying Web Application Firewall (WAF) rules to detect and block suspicious Bearer token patterns, and diligently monitoring access logs for any anomalous activity targeting the /api/connections endpoint.

Considering Cleo’s history of high-impact vulnerabilities, such as the actively exploited CVE-2024-50623 file upload flaw discovered in late 2024, security teams should approach this latest disclosure with equal seriousness. Prompt patching to version 5.8.1.11 remains the most effective method to eliminate this attack vector before it is widely weaponized.

What You Should Do

• Immediately Update: Apply the Cleo Harmony update to version 5.8.1.11 or later. This is the most critical step to mitigate the vulnerability.
• Monitor Network Traffic: Implement strict monitoring for suspicious HTTP requests targeting the /api/connections endpoint, especially those containing unusual Bearer token patterns.
• Deploy WAF Rules: If immediate patching is not feasible, configure Web Application Firewall (WAF) rules to inspect and block malformed or suspicious Bearer tokens in HTTP authorization headers.
• Review Access Logs: Regularly audit access logs for any unauthorized privilege escalation attempts or anomalous activity related to authentication and session management.
• Enforce Input Validation: Strengthen input validation mechanisms for all API requests to prevent the injection of manipulated tokens.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.