PT-2026-34065 · Hkuds+1 · Openharness

Hinotoi-Agent · CVE-2026-6819 · Published 2026-04-21 · Updated 2026-04-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenHarness versions prior to PR #156

Description Plugin lifecycle commands are exposed to remote senders by default. This allows attackers who gain access through the channel layer to remotely manage plugin trust and activation states, which can lead to unauthorized plugin installation and activation on the system. The affected API endpoints include '/plugin install', '/plugin enable', '/plugin disable', and '/reload-plugins'.

Recommendations Update to the version containing PR #156 remediation.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2026-6819

Affected Products

Openharness

References · 7

• 🔥 https://github.com/HKUDS/OpenHarness/pull/156 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6819.json · Exploit
• https://github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2 · Patch
• https://osv.dev/vulnerability/CVE-2026-6819 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-6819 · Security Note
• https://github.com/HKUDS/OpenHarness/releases/tag/v0.1.7 · Note
• https://vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposure · Note