High severity8.8NVD Advisory· Published Apr 21, 2026· Updated May 7, 2026
CVE-2026-6819
CVE-2026-6819
Description
HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2nvdPatch
- github.com/HKUDS/OpenHarness/pull/156nvdExploitIssue TrackingPatch
- www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposurenvdThird Party Advisory
- github.com/HKUDS/OpenHarness/releases/tag/v0.1.7nvdRelease Notes
News mentions
0No linked articles in our index yet.