What’s Vulnerable › Vulnerabilities

CVE-2026-6823: HKUDS OpenHarness Insecure Default Remote Channel Allowlist

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-21 · updated 2026-10-26
• Weakness: CWE-276

Description

HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.

Affected products

• HKUDS OpenHarness: before 0.1.7 — fixed in 0.1.7

How to fix

Upgrade to a fixed version: HKUDS OpenHarness 0.1.7. Check the vendor advisory for mitigations.

References

• https://github.com/HKUDS/OpenHarness/commit/fab40c6eabfb15f2bdf23cddd3cfe66a64ea203d
• https://github.com/HKUDS/OpenHarness/pull/147
• https://github.com/HKUDS/OpenHarness/releases/tag/v0.1.7
• https://www.vulncheck.com/advisories/hkuds-openharness-insecure-default-remote-channel-allowlist
• https://github.com/HKUDS/OpenHarness/pull/147

Get alerted when CVE-2026-6823 or the next vulnerability affects your stack