CVE-2026-56695CWE-862

OpenHarness - Cross-Session Disclosure via /resume and /summary Commands

High · published June 23, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
33.3
In the wild
Unconfirmed
What it is

OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. Attackers can exploit this to access victim snapshots containing private prompts, credentials, tool output, and file paths via shared gateway channels.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00402 · 33.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-23T15:36Z
EPSS history
Timeline
  • 23 JUN 15:36Z
    OpenHarness - Cross-Session Disclosure via /resume and /summary Commands
    cvelistv5