CVE-2026-6819 HKUDS OpenHarness Plugin Management Command Exposure
Attackers can remotely install and enable plugins due to exposed lifecycle commands, leading to unauthorized code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-6819?
CVE-2026-6819 is a high-severity missing authorization vulnerability in HKUDS OpenHarness, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.
Weakness: CWE-276
Which versions are affected by CVE-2026-6819?
It affects 1 product.
Products include Hkuds Openharness.
How do I fix CVE-2026-6819?
No fix has been published for CVE-2026-6819 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-6819 being exploited?
There is no known exploitation of CVE-2026-6819 in the wild and no public exploit code.
Other vulnerabilities in HKUDS OpenHarness
- CVE-2026-7551 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
- CVE-2026-40515 OpenHarness Permission Bypass via grep and glob root argument
- CVE-2026-40502 OpenHarness Remote Administrative Command Injection via Gateway Handler
- CVE-2026-6823 HKUDS OpenHarness Insecure Default Remote Channel Allowlist
- CVE-2026-40516 OpenHarness SSRF via web_fetch and web_search
Sources
Also known as GHSA-3xqw-r49f-5rj8.