CVE-2026-56695

Published: Jun 23, 2026Modified: Jun 24, 2026Deferred

7.1

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (4)

https://github.com/HKUDS/OpenHarness/commit/92e298852c9b9c8c2266236292073623418c640a

Source: disclosure@vulncheck.com

https://github.com/HKUDS/OpenHarness/pull/276

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/openharness-cross-session-disclosure-via-resume-and-summary-commands

Source: disclosure@vulncheck.com

https://github.com/HKUDS/OpenHarness/pull/276

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.