漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
HKUDS OpenHarness Insecure Default Remote Channel Allowlist
Vulnerability Description
HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote senders to pass admission checks. Attackers who can reach the configured channel can bypass access controls and reach host-backed agent runtimes, potentially leading to unauthorized file disclosure and read access through default-enabled read-only tools.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Vulnerability Type
缺省权限不正确
Vulnerability Title
OpenHarness 安全漏洞
Vulnerability Description
OpenHarness是Data Intelligence Lab@HKU开源的一个轻量级智能体开发与运行框架。 OpenHarness PR #147之前版本存在安全漏洞，该漏洞源于远程通道继承allow_from = [ * ]的不安全默认配置，允许任意远程发送者通过准入检查，可能导致攻击者绕过访问控制，访问主机代理运行时，造成未授权文件泄露和读取访问。
CVSS Information
N/A
Vulnerability Type
N/A