Is there a patch available for CVE-2026-56696?

Yes, a patch is available for CVE-2026-56696. Update the affected software to the latest version immediately.

OpenHarness CVE-2026-56696

Q: What is the CVSS score of CVE-2026-56696?

CVE-2026-56696 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38469 MEDIUM

Missing Authorization (CWE-862)

2026-06-23 VulnCheck

GHSA-24cw-228q-3rx9

Authentication Bypass Openharness Hkuds

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.4 MEDIUM

Network vector and low-privilege channel membership (PR:L); scope changes to agent runtime via injected system prompt (S:C); limited confidentiality and integrity impact, no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 16:04 vuln.today

Analysis Generated

Jun 23, 2026 - 16:04 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on openharness-ai (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.1.9.

DescriptionCVE.org

OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdown into project context files. Admitted remote attackers can inject malicious content into .openharness/issue.md and .openharness/pr_comments.md files, which are subsequently injected into runtime system prompts, persistently influencing local agent behavior.

AnalysisAI

Remote prompt injection in OpenHarness allows low-privileged messaging channel participants to persistently corrupt AI agent system prompts by exploiting unguarded /issue and /pr_comments slash commands. Any authenticated member of a connected remote channel (e.g., Slack via the ohmo gateway) can write arbitrary attacker-controlled Markdown into .openharness/issue.md and .openharness/pr_comments.md, which are subsequently injected into the agent's runtime system prompt on every subsequent invocation. No public exploit or CISA KEV listing exists at time of analysis, but the upstream patch (PR #272, commit 27bb93b) confirms the vulnerability and its mechanism.

Technical ContextAI

OpenHarness (CPE: cpe:2.3:a:hkuds:openharness:*:*:*:*:*:*:*:*) is an AI agent framework developed by HKUDS that supports slash command dispatch from remote messaging integrations such as Slack via the ohmo gateway. Commands are registered in src/openharness/commands/registry.py using a SlashCommand abstraction that includes a remote_invocable flag controlling whether the command is accessible from remote channels. Prior to the fix, /issue and /pr_comments were registered without remote_invocable=False, meaning the command registry performed no authorization check before allowing remote senders to invoke these write-capable handlers. CWE-862 (Missing Authorization) precisely captures the root cause: the system exposed a privileged write path to context files without verifying that the caller had the right to invoke it. Because the written files (.openharness/issue.md, .openharness/pr_comments.md) are loaded as part of the agent's system prompt at runtime, the vulnerability enables persistent indirect prompt injection - a class of attack where attacker input reaches an LLM's instruction context through a storage intermediary rather than directly.

RemediationAI

Upstream fix available via PR #272 (https://github.com/HKUDS/OpenHarness/pull/272) and commit 27bb93b (https://github.com/HKUDS/OpenHarness/commit/27bb93b810e9ea8fa4832eab7152eeb3b4a6bffb); update to a release incorporating this commit, which registers /issue and /pr_comments with remote_invocable=False and remote_admin_opt_in=True so these commands are blocked for all remote channel senders by default. A specific tagged release version incorporating this fix is not confirmed from available data - only the commit hash is available; verify the installed package version includes this commit. As a compensating control before patching, restrict the connected messaging channel (e.g., Slack channel used by the ohmo gateway) to trusted internal users only, eliminating untrusted remote participants who could send malicious payloads; this reduces risk but does not eliminate it if any channel member is adversarial. Disabling the remote channel integration entirely removes the attack surface at the cost of losing remote collaboration functionality.