Which versions of OpenHarness are affected by CVE-2026-7551?

CVE-2026-7551 is a remote code execution vulnerability in HKUDS OpenHarness that allows authenticated users with remote sender privileges to execute arbitrary commands on affected systems via the…. A patch is available.

How to fix or mitigate CVE-2026-7551?

Within 24 hours: Identify all HKUDS OpenHarness instances and document which have remote sender privileges enabled and are accessible to untrusted users. Within 7 days: Apply vendor patch (commit 438e373) to all instances; verify /bridge command restrictions are enforced for remote invocations via post-patch testing. Within 30 days: Conduct access control audit to confirm remote sender privileges are assigned only to trusted accounts and implement additional network segmentation if remote access to OpenHarness is business-critical.

OpenHarness CVE-2026-7551

Q: What is the CVSS score of CVE-2026-7551?

CVE-2026-7551 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-26451 HIGH

OS Command Injection (CWE-78)

2026-04-30 VulnCheck

Command Injection RCE Openharness

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 30, 2026 - 22:22 vuln.today

cvss_changed

CVSS changed

Apr 30, 2026 - 22:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

Apr 30, 2026 - 22:01 vuln.today

Analysis Generated

Apr 30, 2026 - 22:01 vuln.today

EUVD ID Assigned

Apr 30, 2026 - 21:45 euvd

EUVD-2026-26451

Analysis Generated

Apr 30, 2026 - 21:45 vuln.today

Patch released

Apr 30, 2026 - 21:45 nvd

Patch available

CVE Published

Apr 30, 2026 - 21:29 nvd

HIGH 8.7

DescriptionCVE.org

HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text that is forwarded to the bridge session manager and executed through the shared shell subprocess helper, allowing them to spawn shell sessions as the OpenHarness process user and access local files, credentials, workspace state, and repository contents.

AnalysisAI

Remote code execution in HKUDS OpenHarness allows authenticated remote attackers to execute arbitrary operating system commands via the /bridge slash command. Attackers with remote sender privileges can invoke '/bridge spawn' with malicious command arguments that bypass input validation and execute directly through the shell subprocess helper, granting access to local files, credentials, workspace state, and repository contents. Vendor-released patch available (commit 438e373) that restricts /bridge to local-only invocation by default.

Technical ContextAI

OpenHarness is an AI-powered development harness that implements a slash command system for managing bridge sessions and runtime environments. The vulnerability exists in the command registry implementation (src/openharness/commands/registry.py) where the /bridge command was registered without the remote_invocable=False flag, allowing remote message sources (Feishu, Slack, etc.) to invoke bridge session spawning. The underlying issue is CWE-78 (OS Command Injection) where user-controlled text from the /bridge spawn command is passed to a shared shell subprocess helper without sanitization. The architecture uses a gateway/runtime pool pattern where inbound messages from multiple channels are routed to command handlers. Prior to the patch, remote senders accepted by configuration could reach the _bridge_handler, which forwards spawn arguments directly to the bridge session manager's shell execution layer.

RemediationAI

Apply vendor-released patch by updating to OpenHarness commit 438e37309778e19060dfe7b172eb142e543c4cd6 or later from the main branch (https://github.com/HKUDS/OpenHarness/commit/438e37309778e19060dfe7b172eb142e543c4cd6). The patch modifies src/openharness/commands/registry.py to register the /bridge command with remote_invocable=False and remote_admin_opt_in=True flags, blocking remote invocation by default while allowing administrators to explicitly enable it if needed. For organizations requiring remote /bridge access, carefully review security implications and implement strict authentication/authorization controls before enabling remote_admin_opt_in. Interim workaround (with operational trade-offs): disable all remote message channel integrations (Feishu/Slack connectors) and restrict OpenHarness access to local UI only, which eliminates the network attack vector but breaks remote collaboration workflows. Alternatively, implement network-level controls to restrict remote message channel access to trusted IP ranges and monitor /bridge command invocations in application logs, though this does not prevent exploitation by authenticated malicious insiders. Verify patch effectiveness by running the new test cases in tests/test_ohmo/test_gateway.py::test_runtime_pool_blocks_bridge_spawn_from_remote_messages.