CVE-2026-6819: HKUDS OpenHarness Plugin Management Command Exposure
HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6819?
CVE-2026-6819 is considered a high severity vulnerability due to the exposure of critical plugin management commands to remote attackers.
How do I fix CVE-2026-6819?
To fix CVE-2026-6819, update to the latest version of HKUDS OpenHarness where the vulnerability has been remediated.
What commands are exposed in CVE-2026-6819?
CVE-2026-6819 exposes commands like /plugin install, /plugin enable, /plugin disable, and /reload-plugins to unauthorized remote access.
Who is affected by CVE-2026-6819?
Any user of HKUDS OpenHarness prior to the remediation in PR #156 is vulnerable to CVE-2026-6819.
What is the impact of CVE-2026-6819?
The impact of CVE-2026-6819 includes unauthorized manipulation of plugins, which can lead to further exploitation or system compromise.