Which versions of OpenHarness are affected by CVE-2026-56695?

HKUDS OpenHarness ohmo gateway's improper access controls on the /resume and /summary endpoints allow remote users to enumerate and load other users' saved session snapshots, exposing stored…. A patch is available.

How to fix or mitigate CVE-2026-56695?

Within 24 hours: Audit all OpenHarness ohmo gateway instances and identify users/channels with cross-session data exposure. Within 7 days: Apply vendor-released patch to all affected gateways (consult vendor advisory for specific version). Within 30 days: Review gateway access logs for /resume and /summary endpoint invocations to confirm no unauthorized cross-session enumeration occurred prior to patching.

OpenHarness CVE-2026-56695

Q: What is the CVSS score of CVE-2026-56695?

CVE-2026-56695 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38467 HIGH

Missing Authorization (CWE-862)

2026-06-23 VulnCheck

GHSA-399c-3gm2-p29v

Authentication Bypass Openharness Hkuds

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Remote over chat bridge with low-privilege admitted-sender membership (PR:L), no user interaction, only confidentiality of other sessions impacted (C:H, I:N, A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 16:00 vuln.today

Analysis Generated

Jun 23, 2026 - 16:00 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on openharness-ai (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.1.9.

DescriptionCVE.org

OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.

AnalysisAI

Cross-session information disclosure in HKUDS OpenHarness ohmo gateway allows admitted remote senders to invoke /resume and /summary slash commands, which were incorrectly registered with remote_invocable=True by default, to enumerate and load arbitrary saved session snapshots by ID. Successful exploitation exposes another user's private prompts, credentials, tool outputs, and file paths exchanged through shared gateway channels (e.g. Slack threads). No public exploit identified at time of analysis, but a vendor patch and detailed test cases (PR #276) make the issue easy to weaponize.

Technical ContextAI

OpenHarness is the HKUDS open-source agent harness; the ohmo subcomponent is a gateway that bridges chat platforms (Slack, etc.) into a local agent runtime. Slash commands are registered through a central SlashCommand registry with a remote_invocable flag that governs whether messages arriving from network-side channels may dispatch the handler. The /summary and /resume control-plane commands were registered without explicitly setting remote_invocable=False, which defaulted them to remotely callable. Because the resume handler accepts a session ID parameter and resolves snapshots from the shared workspace store without scoping by sender_id/channel/session_key, the underlying root cause is CWE-862 (Missing Authorization) on a control-plane primitive that should have been local-UI-only. The fix (commit 92e2988) adds remote_invocable=False and remote_admin_opt_in=True to both registrations, and adds gateway tests asserting that a remote Bob cannot load Alice's snapshot.

RemediationAI

Upstream fix available (PR/commit https://github.com/HKUDS/OpenHarness/pull/276 and commit 92e298852c9b9c8c2266236292073623418c640a); released patched version not independently confirmed, so pull a build that includes that commit from HKUDS/OpenHarness main and redeploy the ohmo gateway. As an interim workaround until the patched build is rolled out, disable the ohmo gateway bridge entirely, or restrict the bridged Slack/chat channels to a single trusted operator so no cross-sender snapshot disclosure is possible - note that this removes the multi-user collaboration use case the gateway is designed for. If you maintain a fork, mirror the fix by registering /resume and /summary with remote_invocable=False and remote_admin_opt_in=True in src/openharness/commands/registry.py; do not attempt to filter by command string at the message layer, as the registry flag is the intended authorization boundary. After patching, rotate any credentials, API keys, or tokens that may have appeared in prior conversation snapshots reachable through the gateway, since prior exposure cannot be ruled out from logs alone.