CVE-2026-40502 - Vulnerability Analysis

Overview

OpenHarness prior to commit dd1d235 contains a command injection caused by insufficient distinction between local-only and remote-safe commands in the gateway handler, letting remote gateway users with chat access execute administrative commands, exploit requires remote chat access.

Severity & Score

Impact

Remote attackers with chat access can execute administrative commands, potentially changing permission modes without authorization.

Mitigation

Update to the commit dd1d235 or later.

References

• https://github.com/HKUDS/OpenHarness/commit/dd1d235450dd987b20bff01b7bfb02fe8620a0af
• https://github.com/HKUDS/OpenHarness/pull/127
• https://www.vulncheck.com/advisories/openharness-remote-administrative-command-injection-via-gateway-handler

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner