CVE-2026-56695 json
OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
published 2026-06-23 4 mo ago modified 2026-11-08 27 h ago also EUVD-2026-38467 , GHSA-399c-3gm2-p29v , PYSEC-2026-3881
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.
Patch / fix
- github.com/HKUDS/OpenHarness@92e2988 commit
- github.com/HKUDS/OpenHarness#276 pull request
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/HKUDS/OpenHarness/pull/276 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | openharness-ai | <=0.1.9 |
no fix listed |
Affected products
- HKUDS OpenHarness
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/HKUDS/OpenHarness/pull/276
issue-tracking, patch, exploit, web
-
github.com
/HKUDS/OpenHarness/commit/92e298852c9b9c8c2266236292073623418c640a
patch, web
-
vulncheck.com
/advisories/openharness-cross-session-disclosure-via-resume-and-summary-commands
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-56695
advisory
-
github.com
/HKUDS/OpenHarness
package
-
pypi.org
/project/openharness-ai
package
-
github.com
/advisories/GHSA-399c-3gm2-p29v
advisory
Sources
- CVE List CVE-2026-56695
- GitHub Advisory GHSA-399c-3gm2-p29v
- NVD CVE-2026-56695
- OSV PYSEC-2026-3881
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.