CVE-2026-110769

Deferred Deferred - Pending Action

Missing Authorization in holaOS Channel-Gateway Connectors

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110769

EUVD

EUVD-2026-101569

Affected Vendors & Products

Vendor	Product	Version / Range
holaboss-ai	holaOS	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1188	The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

Executive Summary

holaOS through 2026.822.1 has a missing authorization vulnerability in its channel-gateway connectors. The system fails to properly check if a messaging platform user is allowed to submit agent tasks. When the default allowFrom list is empty, the #isAllowed check accepts all senders, letting any user of platforms like Telegram, Slack, or Discord send tasks to the operator's system. These tasks are then executed on the operator's machine via the ChannelIngress.handle function.

Detection Guidance

Check if holaOS is installed and verify its version. If the version is 2026.822.1 or earlier, the system is vulnerable. Inspect channel-gateway connector configurations for empty allowFrom lists.

Impact Analysis

If you operate a holaOS system with connected messaging platforms, attackers could send malicious tasks through your bot. These tasks may run tools on your machine, potentially leading to unauthorized code execution, data theft, or system compromise. The impact depends on the tools configured in your holaOS setup.

Compliance Impact

This vulnerability could lead to unauthorized access and data processing, violating GDPR's principles of lawfulness and data minimization. For HIPAA, it may result in unauthorized disclosure of protected health information. Compliance risks include fines, legal liabilities, and reputational damage due to insufficient access controls.

Mitigation Strategies

Update holaOS to the latest version beyond 2026.822.1. If an update is unavailable, disable channel-gateway connectors or configure a strict allowFrom list to restrict authorized senders.

Hi! I’m here to help you understand CVE-2026-110769. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70