CVE-2026-6823
HKUDS OpenHarness Insecure Default Remote Channel Allowlist
Résumé
HKUDS OpenHarness Insecure Default Remote Channel Allowlist
Description d'origine
La description telle que publiée par la source (souvent en anglais).
HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch github.com
- report github.com