CVE-2026-6823

OVERVIEW CVE-2026-6823 is an insecure default configuration vulnerability in HKUDS OpenHarness prior to PR #147 remediation. The flaw allows remote channels to inherit overly permissive access controls (allow_from = ["*"]), enabling any remote sender to bypass admission checks and reach host-backed agent runtimes. This vulnerability could facilitate unauthorized access to sensitive operations and data. SEVERITY The vulnerability carries a CVSS v3.1 score of 8.2 (HIGH) with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The attack surface is global (not bound to a specific scope), resulting in high confidentiality impact through potential file disclosure and read access via default-enabled tools, with limited integrity impact. The FAUCET Risk Score of 50.0/100 indicates moderate risk. EXPLOITATION STATUS The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and shows no signs of active exploitation in the wild. The EPSS score of 0.0008 suggests minimal probability of exploitation in the next 30 days. Community attention remains low, indicating this is not a widely publicized or heavily leveraged vulnerability at this time.