The vulnerability resides in OpenHarness's web_fetch and web_search utilities. By manipulating the parameters supplied to these tools, an attacker can direct the server to perform HTTP requests to arbitrary addresses without validation. This lack of validation leads to server-side request forgery, enabling the attacker to read response bodies from services that are normally inaccessible from the external network, such as local development servers, cloud metadata endpoints, and administration panels.

The flaw is present in all OpenHarness installations that use the web_fetch or web_search features before the commit bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae. The affected product is OpenHarness, classified under the HKUDS vendor. No version numbers are supplied beyond the commit, so any deployment using a pre‑patch copy of the code is vulnerable.

The CVSS score of 7.8 indicates a high severity, though the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited prior exploitation. The likely attack vector is an authenticated or unauthenticated agent session that can trigger the web_fetch or web_search commands. If the attacker can submit crafted parameters through these tools, they can access private services tied to the victim host, potentially exposing sensitive configuration data or internal APIs. Operational impact ranges from data leakage to potential pivoting within the network, depending on the services accessed.