---
id: CVE-2026-6819
title: HKUDS OpenHarness Plugin Management Command Exposure
summary: >-
  HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle
  commands including /plugin install, /plugin enable, /plugin disable, and
  /reload-plugins to remote senders by default. Attackers who gain access
  through the channel …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-276
vendor: HKUDS
product: OpenHarness
affected:
  - 'OpenHarness < PR #156'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-04-22T14:21:41.447218Z'
published: '2026-04-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:08:12.383Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-6819'
references:
  - url: 'https://github.com/HKUDS/OpenHarness/pull/156'
    label: Pull Request
  - url: >-
      https://github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2
    label: Patch Commit
  - url: 'https://github.com/HKUDS/OpenHarness/releases/tag/v0.1.7'
    label: OpenHarness 0.1.7 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposure
tags:
  - cve.org
epss: 0.00293
epssPercentile: 0.21995
ingestedAt: '2026-11-08T14:51:22.265Z'
---

## Overview

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.

## Affected

- `OpenHarness < PR #156`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.