PT-2026-51533 · Hkuds · Openharness

Publicado 2026-06-23 · Atualizado 2026-06-23 · CVE-2026-56695

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

OpenHarness ohmo gateway /resume and /summary slash commands default remote invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-56695

Produtos afetados

Openharness

Referências · 4

• https://github.com/HKUDS/OpenHarness/commit/92e298852c9b9c8c2266236292073623418c640a · Correção
• https://github.com/HKUDS/OpenHarness/pull/276 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56695 · Nota de Segurança
• https://vulncheck.com/advisories/openharness-cross-session-disclosure-via-resume-and-summary-commands · Nota