CVE-2026-110769: holaOS - Broken Access Control

CVE-2026-110769 holaOS - Broken Access Control

holaOS through 2026.822.1 contains a broken access control vulnerability in channel-gateway connectors caused by an empty default allowFrom list bypassing #isAllowed check, letting any messaging-platform user submit agent tasks and execute configured tools on the operator's machine, exploit requires attacker to message the operator's bot.

Details

Type: Broken Access Control
Impact: Remote Code Execution
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Published: 14 October 2026
Updated: 15 October 2026
Weakness: CWE-1188

Vendor fix

Update to the latest version beyond 2026.822.1.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-110769
https://github.com/holaboss-ai/holaOS
https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/src/connectors/telegram.ts#L488
https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default
https://www.vulncheck.com/advisories/holaos-through-2026.822.1-missing-authorization-in-channel-gateway-connectors

← All CVEs

CVE-2026-110769 holaOS - Broken Access Control

Details

Vendor fix

References

Is CVE-2026-110769 reachablein your estate?

Is CVE-2026-110769 reachable
in your estate?