Vulnerability · Published Apr 21, 2026 · Assigned by VulnCheck

CVE-2026-6823HKUDS OpenHarness Insecure Default Remote Channel Allowlist

High 8.2

In plain English

A high-severity incorrect default permissions in OpenHarness from HKUDS. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 72.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.

Affected products (as reported)

Vendor	Product	Versions
HKUDS	OpenHarness	0 – before PR #147

Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

Pull Request issue-tracking
Patch Commit patch
Release Notes third-party-advisory
https://www.vulncheck.com/advisories/hkuds-openharness-insecure-default-remote-channel-allowlist third-party-advisory