OpenHarness CVE-2026-6823

Requires that at least one remote channel (Telegram, Slack, Discord, or Feishu) is enabled with the default or explicit allow_from = ["*"] allowlist - the insecure default before PR #147 - and that the attacker can reach that specific configured channel (CVSS AT:P). No credentials or approved identity on the gateway are needed once the channel is reachable (PR:N), and no user interaction is required. Limiting factors: exploitation is scoped to whatever the default-enabled read-only tools expose (file disclosure/read access, not write or code execution), and reachability of closed messaging channels may require the attacker to know or join the channel; operators who set specific allow_from IDs or leave it empty (deny-all) are not exposed.

Signals are mixed. The CVSS 4.0 base of 8.3 (High) reflects a network vector with low complexity and no privileges (AV:N/AC:L/PR:N) but an explicit Attack Requirement (AT:P) - the attacker must be able to reach the specific configured channel - and impact limited to high confidentiality (VC:H) with only low integrity and no availability effect (VI:L/VA:N), consistent with read-only tool exposure rather than code execution. SSVC frames it as poc / automatable=yes / partial technical impact, and a public advisory exists from VulnCheck, so exploitability is real and scriptable. Against that, EPSS is only 0.08% (23rd percentile) and it is not KEV-listed, indicating no observed widespread exploitation. Net: a genuine confidentiality-exposure priority for anyone running OpenHarness with a reachable channel on insecure defaults, but the low deployment footprint and read-only impact ceiling keep aggregate real-world risk moderate rather than critical. The AT:P requirement is the key limiter - exploitation depends on the attacker reaching the channel, which for closed messaging platforms may require knowing/joining the channel.

An operator enables an OpenHarness Telegram (or Slack/Discord/Feishu) channel on a vulnerable version, accepting the default allow_from = ["*"]. An attacker who can reach that channel sends messages that pass admission as an implicitly trusted identity, then invokes default-enabled read-only tools to read files from the host running the agent runtime. Public POC/advisory material from VulnCheck describes the technique, and the automatable=yes SSVC rating means the admission bypass can be scripted.