The vulnerability arises from OpenHarness allowing all remote senders to an inbound channel due to the default allow_from=["*"] configuration. Attackers reaching an exposed channel can therefore bypass admission checks and connect to host‑backed agent runtimes. This can enable the attacker to read files or view host‑backed agent data through read‑only tools that are enabled by default, resulting in unauthorized disclosure of sensitive information.

OpenHarness software from HKUDS. The issue exists in all releases prior to the fix introduced in PR #147, which is distributed as v0.1.7 and later.

The CVSS score of 8.3 reflects a high severity assessment, and the EPSS score is not available, so current exploitation probability cannot be quantified. It is not listed in CISA KEV, indicating no known widespread exploitation. The vulnerability can be exploited by remote attackers who can reach a configured channel; due to the allow_from=["*"] default, they can bypass access controls and directly interact with the host‑backed agent runtime, potentially reading confidential files via default read‑only tools. The lack of an official workaround means mitigation relies on applying the vendor patch or reconfiguring channels.