EUVD-2026-38467
GHSA-399c-3gm2-p29v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin shared bridged chat channel
-
DeliverySend /resume or /summary with target session ID
-
ExploitGateway dispatches remote-invocable command
-
ExecutionHandler loads victim snapshot from workspace store
-
PersistSnapshot contents returned to attacker's channel message
-
ImpactExfiltrate prompts, credentials, and tool output
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires (1) the OpenHarness ohmo gateway to be running and bridged to a remote chat platform such as Slack, (2) the attacker to be an 'admitted' sender on a shared channel/thread bridged to the victim's gateway (PR:L - membership in the shared chat surface, not OpenHarness authentication), and (3) the attacker to know or guess a target session ID, though /resume with no argument also restores the latest session of the targeted runtime. Exploitation is blocked when ohmo gateway is disabled or only used local-UI-only, when no other users share the bridged channel, or after PR #276 is applied (registry sets remote_invocable=False). No user interaction by the victim is required; no MFA or platform-specific build constraints apply. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N indicates a network-reachable, low-complexity attack requiring only low privileges (an 'admitted' gateway sender - typically anyone with access to a shared Slack channel or thread bridged to the gateway), no user interaction, and resulting in high confidentiality impact with no integrity or availability impact, yielding the 7.1 base score. EPSS and CISA KEV status are not provided in the input; given the niche deployment footprint and a same-week disclosure, real-world exploitation is unlikely to be widespread yet, but the bug is trivial to reach for anyone in a shared bridged channel and the patch diff plus VulnCheck advisory effectively document the exploitation steps. Priority should be high for any team running ohmo gateway bridges into multi-tenant chat channels, and low if ohmo is only used in single-user local mode; the description and patch are mutually consistent, so no conflicting signals require vendor confirmation. |
| Exploit ScenarioDerived | An attacker who shares a Slack channel or thread bridged into a victim's ohmo gateway sends the message '/resume <guessed-or-enumerated-session-id>' and receives the restored conversation contents - including system prompts, tool output, and any secrets the victim pasted - back into the shared channel, or uses '/summary' to obtain a condensed version. The patch's own test case (test_runtime_pool_blocks_registered_resume_without_listing_or_loading_other_sessions) effectively documents the exploit by demonstrating Bob loading Alice's snapshot containing ALICE_PRIVATE_RESUME_SECRET. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 23, 2026
Cross-session information disclosure in HKUDS OpenHarness ohmo gateway allows admitted remote senders to invoke /resume and /summary slash commands, which were incorrectly registered with remote_invocable=True by default, to enumerate and load arbitrary saved session snapshots by ID. Successful exploitation exposes another user's private prompts, credentials, tool outputs, and file paths exchanged through shared gateway channels (e.g. Slack threads). No public exploit identified at time of analysis, but a vendor patch and detailed test cases (PR #276) make the issue easy to weaponize.
RemediationAI
Upstream fix available (PR/commit https://github.com/HKUDS/OpenHarness/pull/276 and commit 92e298852c9b9c8c2266236292073623418c640a); released patched version not independently confirmed, so pull a build that includes that commit from HKUDS/OpenHarness main and redeploy the ohmo gateway. As an interim workaround until the patched build is rolled out, disable the ohmo gateway bridge entirely, or restrict the bridged Slack/chat channels to a single trusted operator so no cross-sender snapshot disclosure is possible - note that this removes the multi-user collaboration use case the gateway is designed for. If you maintain a fork, mirror the fix by registering /resume and /summary with remote_invocable=False and remote_admin_opt_in=True in src/openharness/commands/registry.py; do not attempt to filter by command string at the message layer, as the registry flag is the intended authorization boundary. After patching, rotate any credentials, API keys, or tokens that may have appeared in prior conversation snapshots reachable through the gateway, since prior exposure cannot be ruled out from logs alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenHarness is the HKUDS open-source agent harness; the ohmo subcomponent is a gateway that bridges chat platforms (Slack, etc.) into a local agent runtime. Slash commands are registered through a central SlashCommand registry with a remote_invocable flag that governs whether messages arriving from network-side channels may dispatch the handler. The /summary and /resume control-plane commands were registered without explicitly setting remote_invocable=False, which defaulted them to remotely callable. Because the resume handler accepts a session ID parameter and resolves snapshots from the shared workspace store without scoping by sender_id/channel/session_key, the underlying root cause is CWE-862 (Missing Authorization) on a control-plane primitive that should have been local-UI-only. The fix (commit 92e2988) adds remote_invocable=False and remote_admin_opt_in=True to both registrations, and adds gateway tests asserting that a remote Bob cannot load Alice's snapshot.
Know when Openharness gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Remote over chat bridge with low-privilege admitted-sender membership (PR:L), no user interaction, only confidentiality of other sessions impacted (C:H, I:N, A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.
Blast Radius
ecosystem impact- 1 pypi packages depend on openharness-ai (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 0.1.9.
Executive ViewAI
HKUDS OpenHarness ohmo gateway's improper access controls on the /resume and /summary endpoints allow remote users to enumerate and load other users' saved session snapshots, exposing stored credentials, private prompts, and sensitive work data shared through gateway channels. No public exploit identified at time of analysis, though vendor-provided test cases create straightforward weaponization path. This affects all organization users interacting through shared gateway channels and creates direct risk of credential compromise and unauthorized data access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Openharness
View allRemote code execution in HKUDS OpenHarness allows authenticated remote attackers to execute arbitrary operating system c
Remote command injection in OpenHarness gateway handler allows authenticated remote chat users to execute administrative
Remote attackers can install and activate arbitrary plugins in HKUDS OpenHarness through exposed plugin management comma
Remote unauthenticated attackers can bypass path restrictions in OpenHarness (pre-commit bd4df81) to read arbitrary sens
Improper access control in OpenHarness (prior to commit 166fcfe) allows local authenticated attackers with influence ove
Unauthorized remote access in HKUDS OpenHarness (all versions prior to the PR #147 fix, released as v0.1.7) stems from a
Server-Side Request Forgery in OpenHarness AI agent framework (pre-commit bd4df81) permits remote unauthenticated attack
Path traversal in OpenHarness allows authenticated gateway users with chat access to read arbitrary files on the server
Remote prompt injection in OpenHarness allows low-privileged messaging channel participants to persistently corrupt AI a
Session key derivation in HKUDS OpenHarness prior to PR #159 fails to verify sender identity in shared chat/thread scope
Exploit-DB