Is CVE-2026-56695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56695 being exploited in the wild.

How severe is CVE-2026-56695?

Medium severity, with a CVSS score of 6.5, published 23 June 2026.

Which products and versions are affected?

HKUDS OpenHarness <= 0.1.9; openharness-ai (PyPI) <= 0.1.9, ECOSYSTEM:introduced=0,last_affected=0.1.9.

Is there a fix for CVE-2026-56695?

A patch was published on 2026-05-24: Fix merged in PR #276 on May 24, 2026; advisory published June 23, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56695 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-56695?

Check whether you run HKUDS OpenHarness or openharness-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56695: HKUDS OpenHarness missing authorization in ohmo gateway slash commands

Q: Which products and versions are affected?

HKUDS OpenHarness <= 0.1.9; openharness-ai (PyPI) <= 0.1.9, ECOSYSTEM:introduced=0,last_affected=0.1.9.

Q: Is there a fix for CVE-2026-56695?

A patch was published on 2026-05-24: Fix merged in PR #276 on May 24, 2026; advisory published June 23, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56695 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-56695?

Check whether you run HKUDS OpenHarness or openharness-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56695 · Severity: medium · CVSS 6.5 · Published 2026-06-23

OpenHarness is an AI automation platform with a gateway component that processes commands from remote users. The /resume and /summary commands were enabled for remote invocation by default, allowing any admitted user on a shared gateway to enumerate and load other users' saved session snapshots. This could expose sensitive data such as private conversation history, credentials, tool outputs, and local file paths that another user had saved in their session.

Technologies: HKUDS OpenHarness. Vendors: HKUDS, PyPI.

Quick answers

Is CVE-2026-56695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56695 being exploited in the wild.
How severe is CVE-2026-56695?: Medium severity, with a CVSS score of 6.5, published 23 June 2026.
Which products and versions are affected?: HKUDS OpenHarness <= 0.1.9; openharness-ai (PyPI) <= 0.1.9, ECOSYSTEM:introduced=0,last_affected=0.1.9.
Is there a fix for CVE-2026-56695?: A patch was published on 2026-05-24: Fix merged in PR #276 on May 24, 2026; advisory published June 23, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56695 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-56695?: Check whether you run HKUDS OpenHarness or openharness-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a missing authorization vulnerability (CWE-862) in OpenHarness versions <= 0.1.9. The /resume and /summary slash commands were configured with remote_invocable defaulting to True, allowing any authenticated remote user to invoke them over shared gateway channels. The vulnerable handler uses global session snapshot APIs to list and load saved sessions by ID, bypassing the intended sender-scoped session key isolation that the gateway router otherwise enforces. An admitted remote sender can enumerate another user's saved session snapshots and load them into their own runtime context, then use /summary to extract and return the restored transcript content. The fix (merged May 24, 2026) marks /resume and /summary as local-only by default (remote_invocable=False) and requires explicit remote-admin opt-in for deployments that intentionally allow remote administrative session restoration.

Affected products

OpenHarness openharness-ai <= 0.1.9

Identifiers

CVE-2026-56695
GHSA-399c-3gm2-p29v
PYSEC-2026-3881

Timeline

2026-06-23: disclosed
2026-05-24: patched: Fix merged in PR #276 on May 24, 2026; advisory published June 23, 2026

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.