High severity8.8NVD Advisory· Published Apr 21, 2026· Updated May 7, 2026
CVE-2026-6819
CVE-2026-6819
Description
HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:*range: <0.1.7
- (no CPE)range: < PR #156
Patches
Vulnerability mechanics
References
4- github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2nvdPatch
- github.com/HKUDS/OpenHarness/pull/156nvdExploitIssue TrackingPatch
- www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposurenvdThird Party Advisory
- github.com/HKUDS/OpenHarness/releases/tag/v0.1.7nvdRelease Notes
News mentions
0No linked articles in our index yet.