CVE-2026-6729 HKUDS OpenHarness Session Key Collision Privilege Escalation

What is CVE-2026-6729?

CVE-2026-6729 is a medium-severity authentication bypass vulnerability in HKUDS OpenHarness, published on 20 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions by exploiting a shared ohmo session key that lacks sender identity verification. Attackers can reuse another user's conversation state and replace or interrupt their active tasks by colliding into the same session boundary through the shared chat or thread scope.

Weakness: CWE-287

Which versions are affected by CVE-2026-6729?

It affects 1 product.

Products include Hkuds Openharness.

How do I fix CVE-2026-6729?

No fix has been published for CVE-2026-6729 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-6729 being exploited?

There is no known exploitation of CVE-2026-6729 in the wild and no public exploit code.

Other vulnerabilities in HKUDS OpenHarness

• CVE-2026-7551 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command High 8.7
• CVE-2026-6819 HKUDS OpenHarness Plugin Management Command Exposure High 8.7
• CVE-2026-40515 OpenHarness Permission Bypass via grep and glob root argument High 8.7
• CVE-2026-40502 OpenHarness Remote Administrative Command Injection via Gateway Handler High 8.7
• CVE-2026-6823 HKUDS OpenHarness Insecure Default Remote Channel Allowlist High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pvmf-7x77-8q82.