CVE-2026-40502

OpenHarness prior to commit dd1d235 is vulnerable to a command injection flaw that allows remote users with chat access to execute sensitive administrative commands without proper authorization. The vulnerability stems from insufficient distinction between local-only and remote-safe commands in the gateway handler, enabling attackers to invoke administrative functions such as permission mode changes through remote chat sessions. This affects OpenHarness deployments that have not been patched to the specified commit level. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector, low attack complexity, and low privilege requirements. It delivers high impact across confidentiality, integrity, and availability, as attackers can modify system permissions and configurations of running instances. The EPSS score of 0.00258 indicates this is a relatively uncommon vulnerability in the broader threat landscape. There is no indication of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists. No public exploit code has been identified. The moderate FAUCET risk score of 42.0 suggests limited community attention relative to the technical severity, indicating this may be a less widely deployed product or recently disclosed vulnerability. Organizations running OpenHarness should prioritize patching to commit dd1d235 or later.