{"id":"CVE-2026-40502","title":"OpenHarness Remote Administrative Command Injection via Gateway Handler","summary":"OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and re…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-862"],"vendor":"HKUDS","product":"OpenHarness","affected":["OpenHarness < dd1d235450dd987b20bff01b7bfb02fe8620a0af"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-16T14:17:24.435663Z"},"published":"2026-04-16","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:02:49.050Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40502","references":[{"url":"https://github.com/HKUDS/OpenHarness/pull/127"},{"url":"https://github.com/HKUDS/OpenHarness/commit/dd1d235450dd987b20bff01b7bfb02fe8620a0af"},{"url":"https://www.vulncheck.com/advisories/openharness-remote-administrative-command-injection-via-gateway-handler"}],"tags":["cve.org"],"epss":0.01687,"epssPercentile":0.77183,"ingestedAt":"2026-11-08T14:51:22.444Z","slug":"CVE-2026-40502","body":"## Overview\n\nOpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.\n\n## Affected\n\n- `OpenHarness < dd1d235450dd987b20bff01b7bfb02fe8620a0af`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}