PatchTheCVECVE-2026-7551: HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remo
CVE-2026-7551 is a high-severity flaw (CVSS 8.8) affecting openharness. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn command with attacker-controlled command text that is forwarded to the bridge session manager and executed through the shared shell subprocess helper, allowing them to spawn shell sessions as the OpenHarness process
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.6% (top 49%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2026-04-30 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-7551?
openharness: upgrade to 2026-04-27. Exact commands for each OS are on this page.
Is CVE-2026-7551 being exploited?
CVE-2026-7551 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-7551 affect?
CVE-2026-7551 affects openharness. Severity is high (CVSS 8.8). HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Attackers can invoke the /bridge spawn comman
How urgent is CVE-2026-7551?
Priority 49/100. High severity; Public exploit reference
Related CVEs
- CVE-2026-40503 MEDIUM 6.5 UPGRADE OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gateway users w
- CVE-2026-40502 HIGH 8.8 UPGRADE OpenHarness prior to commit dd1d235 contains a command injection vulnerability that allows remote gateway user
- CVE-2026-6823 HIGH 8.2 UPGRADE HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where
- CVE-2026-40516 HIGH 8.3 UPGRADE OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and we
- CVE-2026-6819 HIGH 8.8 UPGRADE HKUDS OpenHarness prior to PR #156 remediation exposes plugin lifecycle commands including /plugin install, /p