CVE-2026-56695: OpenHarness ohmo Gateway RCE Vulnerability

CVE-2026-56695 Overview

CVE-2026-56695 is a missing authorization vulnerability [CWE-862] in the OpenHarness ohmo gateway. The /resume and /summary slash commands register with remote_invocable defaulting to True. This allows admitted remote senders sharing a gateway channel to enumerate and load arbitrary session snapshots by ID. Attackers can retrieve victim snapshots containing private prompts, credentials, tool output, and file paths.

Critical Impact
Remote authenticated users on shared gateway channels can disclose other users' session data, exposing secrets, prompt history, and filesystem context across tenant boundaries.

Affected Products

OpenHarness ohmo gateway (HKUDS/OpenHarness)
Deployments exposing /resume slash command via remote channels
Deployments exposing /summary slash command via remote channels

Discovery Timeline

2026-06-23 - CVE-2026-56695 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56695

Vulnerability Analysis

The OpenHarness ohmo gateway exposes slash commands to clients sharing a gateway channel. Each SlashCommand registration accepts a remote_invocable flag controlling whether remote senders can trigger the handler. The /resume and /summary commands were registered without overriding the default, leaving remote_invocable=True.

The /resume handler restores saved session state by snapshot ID. The /summary handler reads conversation history for the targeted session. Because authorization is not scoped to the calling user, any admitted participant in the channel can supply another user's snapshot ID and receive its contents. Snapshots persist prompts, tool output, environment context, and file paths processed by the agent.

Root Cause

The root cause is missing authorization on cross-session access [CWE-862]. The command registry treats channel admission as sufficient proof of authorization. There is no per-snapshot ownership check tying a snapshot ID to the requesting principal.

Attack Vector

An attacker admitted to a shared gateway channel sends a /resume or /summary command referencing a snapshot ID belonging to another user. The gateway loads and returns the snapshot without verifying ownership. Attackers can enumerate IDs to harvest secrets, recover ongoing prompt sessions, or extract file paths and tool output exposed during prior runs.

python

# Patch from commit 92e298852c9b9c8c2266236292073623418c640a
# src/openharness/commands/registry.py
 registry.register(SlashCommand("version", "Show the installed OpenHarness version", _version_handler))
 registry.register(SlashCommand("status", "Show session status", _status_handler))
 registry.register(SlashCommand("context", "Show the active runtime system prompt", _context_handler))
-registry.register(SlashCommand("summary", "Summarize conversation history", _summary_handler))
+registry.register(
+    SlashCommand(
+        "summary",
+        "Summarize conversation history",
+        _summary_handler,
+        remote_invocable=False,
+        remote_admin_opt_in=True,
+    )
+)
 registry.register(SlashCommand("compact", "Compact older conversation history", _compact_handler))
-registry.register(SlashCommand("resume", "Restore the latest saved session", _resume_handler))
+registry.register(
+    SlashCommand(
+        "resume",
+        "Restore the latest saved session",
+        _resume_handler,
+        remote_invocable=False,
+        remote_admin_opt_in=True,
+    )
+)

Source: GitHub OpenHarness Commit 92e2988. The patch sets remote_invocable=False and gates the commands behind remote_admin_opt_in=True.

Detection Methods for CVE-2026-56695

Indicators of Compromise

Gateway logs showing /resume or /summary slash commands invoked by remote principals across multiple distinct snapshot IDs.
Snapshot IDs accessed by users who did not create the originating session.
Bursts of /resume calls with sequential or enumerated identifiers.

Detection Strategies

Correlate the requesting user identity against snapshot ownership metadata in gateway logs; flag mismatches.
Alert on high-frequency invocation of /resume and /summary from a single remote sender within a short window.
Inspect outbound responses to slash commands for prompt content, credentials, or file paths returned to a non-owner.

Monitoring Recommendations

Forward ohmo gateway audit logs to a centralized log store and retain command, caller, and snapshot ID fields.
Monitor channel admission events alongside slash command activity to identify newly admitted users probing snapshot IDs.
Track baseline /resume and /summary usage per user and alert on deviations.

How to Mitigate CVE-2026-56695

Immediate Actions Required

Update OpenHarness to a build containing commit 92e2988 from pull request 276.
Restrict gateway channel admission to trusted operators until the patch is applied.
Rotate credentials, API keys, and tokens that may have been present in session prompts or tool output.

Patch Information

The fix is delivered in commit 92e298852c9b9c8c2266236292073623418c640a and merged via OpenHarness PR #276. The patch registers /resume and /summary with remote_invocable=False and remote_admin_opt_in=True, requiring explicit administrator opt-in before remote invocation is allowed. See the VulnCheck advisory for additional context.

Workarounds

Disable the /resume and /summary commands in the gateway registry until upgrade is possible.
Operate ohmo gateways in single-tenant channels so no cross-user snapshot exposure is possible.
Strip or redact sensitive data (credentials, file paths) from agent prompts and tool output to limit disclosure if exploited.

bash

# Pin OpenHarness to a patched revision containing commit 92e2988
pip install --upgrade \
  git+https://github.com/HKUDS/OpenHarness@92e298852c9b9c8c2266236292073623418c640a

# Verify the registry no longer exposes /resume and /summary to remote senders
grep -nE 'register\(SlashCommand\("(resume|summary)"' \
  src/openharness/commands/registry.py