Openharness EUVD-2026-23141

Exploitation requires authenticated access to OpenHarness gateway chat functionality (PR:L indicates low-privileged user credentials sufficient). The gateway handler must be configured to accept remote chat connections, which appears to be default behavior based on the vulnerability description distinguishing between 'local-only' and 'remote-safe' command contexts. No special chat features, non-default settings, or operator interaction required beyond normal authenticated chat session establishment. Exploitation is limited by the need for valid user credentials to the chat interface, but any legitimate chat user can exploit this regardless of their intended authorization level. The vulnerability affects the command validation logic itself, so configurations that expose chat to multiple users or external networks face highest risk. Single-operator deployments where the only chat user is the administrator present minimal realistic risk since the admin already possesses the privileges being escalated.

Real-world risk is substantial despite lack of public exploit confirmation. CVSS 8.7 accurately reflects the severity given the network attack vector (AV:N), low complexity (AC:L), and high impact across confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The requirement for low privileges (PR:L) means any authenticated chat user can exploit this, making it automatable once initial access is obtained. EPSS score unavailable limits statistical exploitation probability assessment. Not present in CISA KEV indicates no confirmed active exploitation at time of analysis, though the vulnerability is recent (2026 timeframe) and may not have reached broad attacker awareness. VulnCheck report suggests security researcher discovery rather than incident-driven disclosure. The ability to modify permission modes creates a privilege escalation path that could disable authentication controls entirely, enabling follow-on attacks. Primary risk applies to organizations exposing OpenHarness gateway chat interfaces to remote users, particularly multi-tenant environments where chat access boundaries should prevent administrative control. Single-tenant deployments with trusted chat users face reduced but non-zero risk from compromised user accounts.

An attacker with valid chat credentials to an OpenHarness gateway establishes a remote chat session and sends the crafted command /permissions full_auto through the chat interface. The vulnerable gateway handler processes this administrative command without verifying the requester's authorization level or command source, immediately changing the instance's permission mode to disable access controls. The attacker can then execute additional administrative commands or access restricted functionality without operator oversight, potentially exfiltrating model data, modifying AI behavior policies, or pivoting to underlying infrastructure.