# CVE-2026-56695: HKUDS OpenHarness missing authorization in ohmo gateway slash commands

Source: https://junglewise.ai/threats/cve-2026-56695-hkuds-openharness-missing-authorization-in-ohmo-gateway-slash  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-23. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56695 · Severity: medium · CVSS 6.5 · Published 2026-06-23

OpenHarness is an AI automation platform with a gateway component that processes commands from remote users. The /resume and /summary commands were enabled for remote invocation by default, allowing any admitted user on a shared gateway to enumerate and load other users' saved session snapshots. This could expose sensitive data such as private conversation history, credentials, tool outputs, and local file paths that another user had saved in their session.

Technologies: [HKUDS OpenHarness](https://junglewise.ai/threats/technologies/openharness). Vendors: [HKUDS](https://junglewise.ai/threats/vendors/hkuds), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-56695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56695 being exploited in the wild.

**How severe is CVE-2026-56695?** Medium severity, with a CVSS score of 6.5, published 23 June 2026.

**Which products and versions are affected?** HKUDS OpenHarness <= 0.1.9; openharness-ai (PyPI) <= 0.1.9, ECOSYSTEM:introduced=0,last_affected=0.1.9.

**Is there a fix for CVE-2026-56695?** A patch was published on 2026-05-24: Fix merged in PR #276 on May 24, 2026; advisory published June 23, 2026 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56695 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-56695?** Check whether you run HKUDS OpenHarness or openharness-ai (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a missing authorization vulnerability (CWE-862) in OpenHarness versions <= 0.1.9. The /resume and /summary slash commands were configured with remote_invocable defaulting to True, allowing any authenticated remote user to invoke them over shared gateway channels. The vulnerable handler uses global session snapshot APIs to list and load saved sessions by ID, bypassing the intended sender-scoped session key isolation that the gateway router otherwise enforces. An admitted remote sender can enumerate another user's saved session snapshots and load them into their own runtime context, then use /summary to extract and return the restored transcript content. The fix (merged May 24, 2026) marks /resume and /summary as local-only by default (remote_invocable=False) and requires explicit remote-admin opt-in for deployments that intentionally allow remote administrative session restoration.

## Affected products

- OpenHarness openharness-ai <= 0.1.9

## Identifiers

- CVE-2026-56695
- GHSA-399c-3gm2-p29v
- PYSEC-2026-3881

## Timeline

- 2026-06-23: disclosed
- 2026-05-24: patched: Fix merged in PR #276 on May 24, 2026; advisory published June 23, 2026

## References

- [https://github.com/HKUDS/OpenHarness/pull/276](https://github.com/HKUDS/OpenHarness/pull/276)
- [https://github.com/HKUDS/OpenHarness/commit/92e298852c9b9c8c2266236292073623418c640a](https://github.com/HKUDS/OpenHarness/commit/92e298852c9b9c8c2266236292073623418c640a)
- [https://www.vulncheck.com/advisories/openharness-cross-session-disclosure-via-resume-and-summary-commands](https://www.vulncheck.com/advisories/openharness-cross-session-disclosure-via-resume-and-summary-commands)

## Related threats

- [HKUDS OpenHarness prompt injection via slash commands](https://junglewise.ai/threats/cve-2026-56696-hkuds-openharness-prompt-injection-via-slash-commands)
- [HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote…](https://junglewise.ai/threats/cve-2026-7551-hkuds-openharness-contains-a-remote-code-execution-vulnerability)
- [HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote…](https://junglewise.ai/threats/cve-2026-6823-hkuds-openharness-prior-to-pr-147-remediation-contains-an-insecure)
- [HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /plugin…](https://junglewise.ai/threats/cve-2026-6819-hkuds-openharness-prior-to-pr-156-remediation-exposes-plugin)
- [HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows…](https://junglewise.ai/threats/cve-2026-6729-hkuds-openharness-prior-to-pr-159-remediation-contains-a-session)