Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40502 OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative co… https://www.cve.org/CVERecord?id=CVE-2026-40502
Post summary
CVE-2026-40502 is a command injection vulnerability present in OpenHarness before commit dd1d235, enabling remote gateway users with chat access to execute administrative commands.
CVE-2026-40502 Remote Command Injection in OpenHarness Prior to Commit dd1d235 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40502
Post summary
The text announces CVE-2026-40502, identifying a remote command injection flaw in OpenHarness before commit dd1d235, without providing a PoC, exploit, or mitigation information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | hkuds | openharness | - | - | - |