CVE-2026-40502High· 8.8▾ TwilightOpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and re…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.7%
OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.
OpenHarness < dd1d235450dd987b20bff01b7bfb02fe8620a0afRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-40503Medium· 6.5OpenHarness Path Traversal Information Disclosure via /memory show
CVE-2026-56695Medium· 6.5OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
CVE-2026-56696Medium· 5.4OpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands
CVE-2026-22682High· 7.1OpenHarness Improper Access Control via File Tools
CVE-2026-40515High· 7.5OpenHarness Permission Bypass via grep and glob root argument
CVE-2026-40516High· 8.3OpenHarness SSRF via web_fetch and web_search