CVE-2026-40502
Last modified
CVE-2026-40502 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.. EPSS estimates a 1.69% chance of exploitation in the next 30 days.
Description
OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway users with chat access to invoke sensitive administrative commands by exploiting insufficient distinction between local-only and remote-safe commands in the gateway handler. Attackers can execute administrative commands such as /permissions full_auto through remote chat sessions to change permission modes of a running OpenHarness instance without operator authorization.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Hkuds | Openharness | < 2026-04-13 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-40502?
How severe is CVE-2026-40502?
How do I fix CVE-2026-40502?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-40496FreeScout is a free self-hosted help desk and shared mailbox…9.1
- CVE-2026-40497FreeScout is a free self-hosted help desk and shared mailbox…8.1
- CVE-2026-40498FreeScout is a free self-hosted help desk and shared mailbox…9.8
- CVE-2026-40499radare2 prior to version 6.1.4 contains a command injection …7.8
- CVE-2026-40500Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2026-40501Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit…8.8
- CVE-2026-40503OpenHarness prior to commit dd1d235 contains a path traversa…7.1
- CVE-2026-40504Creolabs Gravity before 0.9.6 contains a heap buffer overflo…9.8
- CVE-2026-40505MuPDF before 1.27 contains an ANSI injection vulnerability i…4.8
- CVE-2026-40506OpenEMR before 8.2.0 contains a path traversal vulnerability…6.5
- CVE-2026-40507OpenEMR before 8.3.0 contains a reflected cross-site scripti…6.1
- CVE-2026-40508OpenEMR before 8.3.0 contains a stored cross-site scripting …5.4
Are you affected by CVE-2026-40502?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST