The vulnerability CVE-2026-40502 in HKUDS OpenHarness is a missing authorization issue (CWE-862) that allows remote users with chat access to invoke administrative commands due to insufficient differentiation between local-only and remote-safe commands in the gateway handler. This command injection flaw permits execution of commands such as '/permissions full_auto' remotely, altering permission modes without operator authorization. The affected versions are prior to commit dd1d235. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers with chat access to execute administrative commands on the OpenHarness instance, changing permission modes without authorization. This can lead to unauthorized privilege escalation and potential full control over the affected system, severely impacting confidentiality, integrity, and availability of the service.

No official patch or remediation level has been published yet for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict remote chat access to trusted users only and monitor for unusual command executions. Avoid exposing OpenHarness gateway chat interfaces to untrusted networks.