HKUDS OpenHarness versions prior to the fix referenced as PR #156 suffer from incorrect default permissions (CWE-276) that expose critical plugin lifecycle management commands to remote actors. These commands include installing, enabling, disabling plugins, and reloading plugins. Because these commands are accessible remotely without proper authentication or authorization controls, an attacker with channel layer access can manipulate plugin states, potentially installing or activating unauthorized plugins. This vulnerability is scored 8.7 on CVSS 4.0, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No official patch or remediation level is documented, and no exploits are known in the wild.

The vulnerability allows remote attackers to manage plugin lifecycle commands without proper authorization, which can lead to unauthorized plugin installation and activation. This compromises system integrity and confidentiality by allowing potentially malicious plugins to be installed and executed. The high CVSS score reflects significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the channel layer and plugin management interfaces through network controls or other means may reduce exposure.