CVE-2026-56695

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-56695

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56695.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-56695

Published

2026-06-23T15:36:01.873Z

Modified

2026-08-12T03:51:37.409130671Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenHarness - Cross-Session Disclosure via /resume and /summary Commands

Details

OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.

Database specific

{
    "cwe_ids": [
        "CWE-862"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56695.json"
}

References

Affected packages

Git / github.com/hkuds/openharness

Affected ranges

Type

GIT

Repo

https://github.com/hkuds/openharness

Events

Introduced

Fixed

92e298852c9b9c8c2266236292073623418c640a

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.1.9"
        }
    ]
}

Affected versions

v0.*

v0.1.6

v0.1.7

v0.1.8

v0.1.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-56695.json"