← Back to CVEs

CVE-2026-6819

HIGH

8.8

Description

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

Published4/21/2026

Last Modified4/22/2026

Sourcenvd

Honeypot Sightings0

Weaknesses (CWE)

CWE-276

References

https://github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2(disclosure@vulncheck.com)

https://github.com/HKUDS/OpenHarness/pull/156(disclosure@vulncheck.com)

https://github.com/HKUDS/OpenHarness/releases/tag/v0.1.7(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposure(disclosure@vulncheck.com)

https://github.com/HKUDS/OpenHarness/pull/156(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.