CVE-2026-6823: HKUDS OpenHarness Insecure Default Remote Channel Allowlist
HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allowfrom = [""] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update HKUDS OpenHarness remote channel configuration so remote channels do not inherit allow_from = ["*"]; restrict allow_from to the specific, authorized remote sender addresses permitted to reach the configured channel (i.e., remove the insecure wildcard default).
HKUDS OpenHarness remote channel allowlist allow_from = configured to not include "*"
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6823?
CVE-2026-6823 is classified as a high severity vulnerability due to the potential for arbitrary remote senders to bypass admission checks.
How do I fix CVE-2026-6823?
To fix CVE-2026-6823, update to the latest version of HKUDS OpenHarness where the insecure default configuration has been remediated.
What is the impact of CVE-2026-6823?
The impact of CVE-2026-6823 allows unauthorized remote entities to interact with the system due to the insecure default channel allowlist.
Which versions of HKUDS OpenHarness are affected by CVE-2026-6823?
CVE-2026-6823 affects all versions of HKUDS OpenHarness prior to the remediation implemented in PR #147.
Is there a known exploit for CVE-2026-6823?
While specific exploits may not be publicly detailed, the vulnerability creates a significant risk for arbitrary remote access which could be exploited by attackers.