Read the docs
TI-2026-05985 Aliases CVE-2026-6823GHSA-564h-hx6x-wg47

HKUDS OpenHarness Insecure Default Remote Channel Allowlist

Priority HIGH 75CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:*before 0.1.7VulnerableHKUDS
  • cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:* Versions before 0.1.7 Vulnerable ·HKUDS

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6823
  2. 2026-10-03 Alias added: GHSA-564h-hx6x-wg47

References

Exploit 1

Patch 1

Advisory 1

  • TI-2026-29263 OpenHarness SSRF via web_fetch and web_search CVSS 4.0HIGH 7.8
  • TI-2026-29262 OpenHarness Permission Bypass via grep and glob root argument CVSS 4.0HIGH 8.7
  • TI-2026-29252 OpenHarness Remote Administrative Command Injection via Gateway Handler CVSS 4.0HIGH 8.7
  • TI-2026-06639 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command CVSS 4.0HIGH 8.7
  • TI-2026-05982 HKUDS OpenHarness Plugin Management Command Exposure CVSS 4.0HIGH 8.7
  • TI-2026-29253 OpenHarness Path Traversal Information Disclosure via /memory show CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences