CVE-2026-6823 HKUDS OpenHarness Insecure Default Remote Channel Allowlist
Attackers can bypass access controls and read files via insecure default allowlists in HKUDS OpenHarness remote channels.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-6823?
CVE-2026-6823 is a high-severity vulnerability in HKUDS OpenHarness, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.
Weakness: CWE-276
Which versions are affected by CVE-2026-6823?
It affects 1 product.
Products include Hkuds Openharness.
How do I fix CVE-2026-6823?
No fix has been published for CVE-2026-6823 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-6823 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-6823 exists.
Other vulnerabilities in HKUDS OpenHarness
- CVE-2026-7551 HKUDS OpenHarness Remote Command Execution via /bridge Slash Command
- CVE-2026-6819 HKUDS OpenHarness Plugin Management Command Exposure
- CVE-2026-40515 OpenHarness Permission Bypass via grep and glob root argument
- CVE-2026-40502 OpenHarness Remote Administrative Command Injection via Gateway Handler
- CVE-2026-40516 OpenHarness SSRF via web_fetch and web_search
Sources
Also known as GHSA-564h-hx6x-wg47.