CVE-2026-6819

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-6819

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6819.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-6819

Published

2026-04-21T19:41:16.229Z

Modified

2026-08-05T03:32:40.821026304Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

HKUDS OpenHarness Plugin Management Command Exposure

Details

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation state, enabling unauthorized plugin installation and activation on the system.

Database specific

{
    "cwe_ids": [
        "CWE-276"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6819.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "PR #156"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/hkuds/openharness

Affected ranges

Type

GIT

Repo

https://github.com/hkuds/openharness

Events

Introduced

Fixed

59017e09880fcf9a6f60456a84fb982900b2c0b2

Fixed

35fb12d5da3564943d8d9f3f6ef151b4b61597cd

Database specific

{
    "source": "REFERENCES"
}

Affected versions

v0.*

v0.1.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6819.json"