CVE-2026-6819: HKUDS OpenHarness Plugin Management Command Exposure

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-21 · updated 2026-10-26
Weakness: CWE-276

Description

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.

Affected products

HKUDS OpenHarness: before 0.1.7 — fixed in 0.1.7

How to fix

Upgrade to a fixed version: HKUDS OpenHarness 0.1.7. Check the vendor advisory for mitigations.

References

https://github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2
https://github.com/HKUDS/OpenHarness/pull/156
https://github.com/HKUDS/OpenHarness/releases/tag/v0.1.7
https://www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposure
https://github.com/HKUDS/OpenHarness/pull/156

Get alerted when CVE-2026-6819 or the next vulnerability affects your stack