CVE-2026-6819

HighPublic PoC

Published: 21 April 2026

Published

21 April 2026

Modified

07 May 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0003 10.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-6819 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Hkuds Openharness. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match

prevent

Principle of least privilege ensures plugin lifecycle commands are only accessible to authorized users or processes, directly preventing unauthorized remote management and activation of plugins.

AC-3 Access Enforcement good match

prevent

Access enforcement mechanisms restrict execution of exposed plugin commands like install, enable, and disable to approved entities, blocking exploitation by remote senders.

CM-7 Least Functionality good match

prevent

Least functionality prohibits unnecessary exposure of plugin management commands to remote senders by default, eliminating the incorrect permission configuration.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

Why these techniques?

The vulnerability exposes plugin lifecycle commands to remote attackers via the channel layer, directly enabling exploitation of a public-facing application (T1190) to achieve unauthorized plugin installation and activation, which facilitates ingress of malicious tools/plugins (T1105).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to remote senders by default. Attackers who gain access through the channel layer can remotely manage plugin trust and activation…

state, enabling unauthorized plugin installation and activation on the system.

Deeper analysisAI

CVE-2026-6819 is a vulnerability in HKUDS OpenHarness prior to the remediation in Pull Request #156, where plugin lifecycle commands such as /plugin install, /plugin enable, /plugin disable, and /reload-plugins are exposed to remote senders by default. This incorrect default permissions issue, classified under CWE-276, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.

Remote attackers can exploit this vulnerability by gaining access through the channel layer, which requires user interaction. Once access is obtained, they can remotely manage plugin trust and activation states, enabling unauthorized installation and activation of plugins on the affected system.

Advisories and patches recommend applying the fix from Pull Request #156, available in the commit at https://github.com/HKUDS/OpenHarness/commit/59017e09880fcf9a6f60456a84fb982900b2c0b2 and included in release v0.1.7 at https://github.com/HKUDS/OpenHarness/releases/tag/v0.1.7. Additional details are provided in the VulnCheck advisory at https://www.vulncheck.com/advisories/hkuds-openharness-plugin-management-command-exposure.