Vulnerability · Published Apr 21, 2026 · Assigned by VulnCheck

CVE-2026-6819HKUDS OpenHarness Plugin Management Command Exposure

High 8.8

In plain English

A high-severity incorrect default permissions in OpenHarness from HKUDS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.3%top 78.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.

Affected products (as reported)

Vendor	Product	Versions
HKUDS	OpenHarness	0 – before PR #156

Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Pull Request issue-tracking
Patch Commit patch
Release Notes
https://www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposure third-party-advisory