CVE-2026-6819

CVE-2026-6819 is a remote code execution vulnerability in HKUDS OpenHarness versions prior to PR #156 that exposes critical plugin lifecycle management commands including /plugin install, /plugin enable, /plugin disable, and /reload-plugins to unauthenticated remote attackers. This exposure allows adversaries who gain access to the channel layer to remotely install unauthorized plugins and manipulate plugin activation states without legitimate authorization. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network-based attack vector requiring no authentication or user interaction, making it trivial for attackers to exploit. Successful exploitation results in complete compromise of system confidentiality, integrity, and availability through arbitrary plugin execution and system control. While CVE-2026-6819 does not currently appear in the Known Exploited Vulnerabilities catalog, it is actively listed on security tracking platforms and demonstrates elevated community attention relative to other CVEs. Organizations running vulnerable versions of OpenHarness should prioritize patching to PR #156 or later given the critical nature of remote unauthenticated code execution capabilities.