Vulnerability · Published Apr 16, 2026 · Assigned by VulnCheck

CVE-2026-40502OpenHarness Remote Administrative Command Injection via Gateway Handler

High 8.8

In plain English

A high-severity missing authorization in OpenHarness from HKUDS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.7%top 22.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.

Affected products (as reported)

Vendor	Product	Versions
HKUDS	OpenHarness	0 – before dd1d235450dd987b20bff01b7bfb02fe8620a0af

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/HKUDS/OpenHarness/pull/127 issue-tracking
https://github.com/HKUDS/OpenHarness/commit/dd1d235450dd987b20bff01b7bfb02fe8620a0af patch
https://www.vulncheck.com/advisories/openharness-remote-administrative-command-injection-via-gateway-handler third-party-advisory