Remote Command Vulnerability in OpenHarness Ohmo Gateway
CVE-2026-56695

7.1HIGH

Key Information:

Vendor

Hkuds

Status
Openharness
Vendor
CVE Published:
23 June 2026

What is CVE-2026-56695?

The OpenHarness Ohmo Gateway has a security flaw within its /resume and /summary commands. These commands have a default setting that permits remote invocation, allowing authorized external users to access and manipulate arbitrary session snapshots by their IDs. This flaw can be leveraged by attackers to enumerate sensitive data, including private prompts, user credentials, tool outputs, and file paths. The exposure of this private data through shared gateway channels represents a significant risk. Remediation efforts are recommended to patch this vulnerability to secure user information.

Affected Version(s)

OpenHarness 0 <= 0.1.9

OpenHarness 92e298852c9b9c8c2266236292073623418c640a

References

https://github.com/HKUDS/OpenHarness/pull/276
issue-tracking
https://github.com/HKUDS/OpenHarness/commit/92e298852c9b9...
patch
https://www.vulncheck.com/advisories/openharness-cross-se...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chia Min Jun Lennon
.