HKUDS OpenHarness versions prior to the remediation PR #156 expose critical plugin lifecycle commands (/plugin install, /plugin enable, /plugin disable, /reload-plugins) to remote senders by default due to incorrect default permissions (CWE-276). This exposure enables attackers who gain access through the channel layer to remotely manage plugin trust and activation states, potentially installing and activating unauthorized plugins on the system. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, and high impact on confidentiality, integrity, and availability.

An attacker can remotely execute plugin lifecycle commands without authentication, leading to unauthorized plugin installation and activation. This compromises system integrity and potentially confidentiality and availability by allowing malicious plugins to run with system privileges. The vulnerability affects all versions prior to the remediation PR #156. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability is fixed in PR #156, applying this official fix or update when available is recommended. Until then, restrict remote access to the channel layer to trusted users only to mitigate unauthorized command execution.