CVE-2026-6819 describes a vulnerability in HKUDS OpenHarness (version 0) where plugin lifecycle commands such as /plugin install, /plugin enable, /plugin disable, and /reload-plugins are exposed to remote attackers by default. This exposure stems from incorrect default permissions (CWE-276), allowing unauthorized remote management of plugin trust and activation state. Attackers who gain access through the channel layer can exploit this to install or activate plugins without authorization, potentially compromising the system. There is no vendor-provided remediation or patch information available at this time.

An attacker with access to the channel layer can remotely execute plugin lifecycle commands, enabling unauthorized installation and activation of plugins. This can lead to unauthorized code execution or system compromise. The CVSS 4.0 base score is 8.7 (high), reflecting the network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or mitigation is provided, restrict access to the channel layer to trusted entities only and monitor for unauthorized plugin management activity. Avoid exposing the vulnerable commands to untrusted remote senders.