PT-2026-34065

CVE-2026-6819

Published

2026-04-21

Updated

2026-04-21

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenHarness versions prior to PR #156

Description Plugin lifecycle commands are exposed to remote senders by default. This allows attackers who gain access through the channel layer to remotely manage plugin trust and activation states, which can lead to unauthorized plugin installation and activation on the system. The affected API endpoints include '/plugin install', '/plugin enable', '/plugin disable', and '/reload-plugins'.

Recommendations Update to the version containing PR #156 remediation.

Exploitability

Exploit

Fix

Impacts

Researchers

Hinotoi-Agent

Vendors

Affected products

Weakness enumeration

CWE-276: Incorrect Default Permissions

Related identifiers