CVE-2026-40502 OpenHarness Remote Administrative Command Injection via Gateway Handler

What is CVE-2026-40502?

CVE-2026-40502 is a high-severity command injection vulnerability in HKUDS OpenHarness, published on 16 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.

Weakness: CWE-862

Which versions are affected by CVE-2026-40502?

It affects 1 product.

Products include Hkuds Openharness.

How do I fix CVE-2026-40502?

No fix has been published for CVE-2026-40502 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-40502 being exploited?

There is no known exploitation of CVE-2026-40502 in the wild and no public exploit code.

Other vulnerabilities in HKUDS OpenHarness

• CVE-2026-7551 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command High 8.7
• CVE-2026-6819 HKUDS OpenHarness Plugin Management Command Exposure High 8.7
• CVE-2026-40515 OpenHarness Permission Bypass via grep and glob root argument High 8.7
• CVE-2026-6823 HKUDS OpenHarness Insecure Default Remote Channel Allowlist High 8.3
• CVE-2026-40516 OpenHarness SSRF via web_fetch and web_search High 7.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9w66-jgph-vx6j.