CVE-2026-6819: HKUDS OpenHarness Privilege Escalation Flaw

CVE-2026-6819 Overview

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. This Improper Access Control vulnerability (CWE-276: Incorrect Default Permissions) allows attackers who gain access through the channel layer to remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.

Critical Impact

Attackers with channel layer access can remotely install and activate untrusted plugins, potentially leading to arbitrary code execution on affected OpenHarness instances.

Affected Products

• HKUDS OpenHarness versions prior to v0.1.7
• OpenHarness installations without PR #156 remediation applied
• Any OpenHarness deployment exposing the channel layer to untrusted networks

Discovery Timeline

• 2026-04-21 - CVE-2026-6819 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6819

Vulnerability Analysis

This vulnerability stems from insecure default configurations in OpenHarness's command registration system. The plugin management commands (/plugin and /reload-plugins) were registered without proper access control restrictions, making them accessible to remote senders by default. This design flaw allows any entity with access to the channel layer to invoke privileged plugin management operations without authentication or authorization checks.

The vulnerability is particularly dangerous because plugin activation in OpenHarness can lead to code execution. An attacker who can install and enable malicious plugins gains the ability to execute arbitrary code within the context of the OpenHarness application, potentially compromising the entire system.

Root Cause

The root cause is CWE-276 (Incorrect Default Permissions). The SlashCommand registrations for plugin management functionality lacked the remote_invocable=False and remote_admin_opt_in=True security flags that restrict remote invocation. By default, these commands were exposed to all senders, including remote untrusted sources accessing the channel layer.

Additionally, the configuration settings lacked a allow_project_plugins flag to control whether project-level plugins could be loaded, providing no safeguard against loading untrusted plugin code.

Attack Vector

The attack is network-based and requires an attacker to gain access to the OpenHarness channel layer. Once access is obtained, the attacker can:

1. Issue /plugin install commands to install malicious plugins
2. Use /plugin enable to activate the installed malicious plugins
3. Utilize /reload-plugins to refresh the plugin discovery and load malicious code
4. Achieve code execution through the activated untrusted plugin

The following patch from PR #156 addresses the vulnerability in src/openharness/commands/registry.py:

     registry.register(SlashCommand("skills", "List or show available skills", _skills_handler))
     registry.register(SlashCommand("config", "Show or update configuration", _config_handler))
     registry.register(SlashCommand("mcp", "Show MCP status", _mcp_handler))
-    registry.register(SlashCommand("plugin", "Manage plugins", _plugin_handler))
-    registry.register(SlashCommand("reload-plugins", "Reload plugin discovery for this workspace", _reload_plugins_handler))
+    registry.register(
+        SlashCommand(
+            "plugin",
+            "Manage plugins",
+            _plugin_handler,
+            remote_invocable=False,
+            remote_admin_opt_in=True,
+        )
+    )
+    registry.register(
+        SlashCommand(
+            "reload-plugins",
+            "Reload plugin discovery for this workspace",
+            _reload_plugins_handler,
+            remote_invocable=False,
+            remote_admin_opt_in=True,
+        )
+    )
     registry.register(
         SlashCommand(
             "permissions",

Source: GitHub Commit Update

The configuration settings patch in src/openharness/config/settings.py adds an additional control:

     memory: MemorySettings = Field(default_factory=MemorySettings)
     sandbox: SandboxSettings = Field(default_factory=SandboxSettings)
     enabled_plugins: dict[str, bool] = Field(default_factory=dict)
+    allow_project_plugins: bool = False
     mcp_servers: dict[str, McpServerConfig] = Field(default_factory=dict)

     # UI

Source: GitHub Commit Update

Detection Methods for CVE-2026-6819

Indicators of Compromise

• Unexpected plugin installations or modifications in the OpenHarness plugins directory
• Log entries showing /plugin install, /plugin enable, /plugin disable, or /reload-plugins commands from remote or unknown sources
• New or unrecognized plugins appearing in the enabled plugins configuration
• Unusual network connections to the OpenHarness channel layer from untrusted IP addresses

Detection Strategies

• Monitor OpenHarness logs for plugin management command invocations, especially those originating from remote senders
• Implement file integrity monitoring on the plugins directory to detect unauthorized plugin installations
• Deploy network monitoring to identify unexpected connections to the channel layer
• Audit the enabled_plugins configuration for unauthorized changes

Monitoring Recommendations

• Enable verbose logging for all slash command invocations in OpenHarness
• Set up alerts for any plugin management commands executed outside of expected maintenance windows
• Monitor for new file creations in plugin directories that don't correspond to authorized deployments
• Review channel layer access logs regularly for unauthorized access attempts

How to Mitigate CVE-2026-6819

Immediate Actions Required

• Upgrade to OpenHarness version v0.1.7 or later, which includes the security fix
• If immediate upgrade is not possible, apply PR #156 manually to your installation
• Restrict network access to the OpenHarness channel layer to trusted sources only
• Audit existing plugin installations for any unauthorized or suspicious plugins

Patch Information

The vulnerability has been addressed in OpenHarness v0.1.7. The fix is implemented in commit 59017e09880fcf9a6f60456a84fb982900b2c0b2, which adds the remote_invocable=False and remote_admin_opt_in=True flags to plugin management commands, and introduces the allow_project_plugins configuration option defaulting to False.

For detailed patch information, see:

• GitHub Pull Request #156
• GitHub Commit 59017e0
• VulnCheck Advisory

Workarounds

• Implement network-level access controls (firewall rules, network segmentation) to restrict access to the channel layer
• Deploy an application-level proxy or gateway to filter and block plugin management commands from remote sources
• Disable the channel layer entirely if remote access is not required for operations
• Manually modify the command registry to add remote_invocable=False to plugin commands if upgrading is not immediately feasible

# Example: Restrict channel layer access using iptables
# Allow only trusted IP addresses to access OpenHarness channel layer port
iptables -A INPUT -p tcp --dport <OPENHARNESS_PORT> -s <TRUSTED_IP_RANGE> -j ACCEPT
iptables -A INPUT -p tcp --dport <OPENHARNESS_PORT> -j DROP