Read the docs
TI-2026-29252 Aliases CVE-2026-40502GHSA-9w66-jgph-vx6j

OpenHarness Remote Administrative Command Injection via Gateway Handler

Priority MEDIUM 43CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01687 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:*before 2026-04-13VulnerableHKUDS
  • cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:* Versions before 2026-04-13 Vulnerable ·HKUDS

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    HKUDS OpenHarness dd1d235450dd987b20bff01b7bfb02fe8620a0af

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2026-29253 OpenHarness Path Traversal Information Disclosure via /memory showPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40502
  2. 2026-10-03 Alias added: GHSA-9w66-jgph-vx6j

References

Exploit 1

Patch 1

  • TI-2026-05985 HKUDS OpenHarness Insecure Default Remote Channel Allowlist CVSS 4.0HIGH 8.3
  • TI-2026-29263 OpenHarness SSRF via web_fetch and web_search CVSS 4.0HIGH 7.8
  • TI-2026-29262 OpenHarness Permission Bypass via grep and glob root argument CVSS 4.0HIGH 8.7
  • TI-2026-06639 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command CVSS 4.0HIGH 8.7
  • TI-2026-05982 HKUDS OpenHarness Plugin Management Command Exposure CVSS 4.0HIGH 8.7
  • TI-2026-29253 OpenHarness Path Traversal Information Disclosure via /memory show CVSS 4.0HIGH 7.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences