Remote Command Exposure in HKUDS OpenHarness Plugin Management

CVE-2026-6819

What is CVE-2026-6819?

The HKUDS OpenHarness plugin has a vulnerability that permits unauthorized access to its plugin lifecycle commands via default settings. Specifically, commands such as /plugin install, /plugin enable, /plugin disable, and /reload-plugins are exposed to remote senders. This flaw allows malicious actors who can exploit the channel layer to remotely manage the trust and activation state of plugins, leading to potential unauthorized installations and activations. Users of OpenHarness are advised to consult the recent patch and update their systems to mitigate this risk.

References