CVE-2026-110769

8.6High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.6High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on integrity
Weakness: CWE-1188

Impact

Remote attackers can execute agent tasks and configured tools on the operator host simply by sending a message to the bot on Telegram, Slack, or Discord. No privileges or authentication are required.

Root cause

The #isAllowed authorization check in channel-gateway connectors treats an empty allowFrom configuration as allowing all senders by default.

Affected systems

holaOS through 2026.822.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Fix & remediation

Upgrade holaOS to a version past 2026.822.1 once available; in the meantime, explicitly configure and populate the allowFrom whitelist for all active bot connectors (Telegram, Slack, Discord).

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-110769