Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110769— holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors

Quick assessment

Affected
holaboss-ai holaOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

holaOS 最高至 2026.822.1 版本存在一个缺失授权检查的安全漏洞，该漏洞出现在 channel-gateway 连接器中。由于当默认的 allowFrom 列表为空时，#isAllowed 检查会接受所有发送者，导致任何消息平台用户均可提交代理任务。攻击者若能向运营商的 Telegram、Slack、Discord 或其他 Bot 发送消息，便可触发 ChannelIngress.handle 方法将对话控制权转交至工作区代理（workspace agent），进而在运营商的机器上执行已配置的工具。

CVSS 8.6 · High EPSS 0.29% · P20

Affected Version Matrix 1

VendorProduct Version RangeStatus
holaboss-ai holaOS ≤ 2026.822.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110769

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors
Source: CVE Program / CVE List V5
Vulnerability Description
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不安全的默认资源初始化
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
holaboss-ai holaOS 0 ~ 2026.822.1 -

II. Public POCs for CVE-2026-110769

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110769

请登录查看更多情报信息。

Other References for CVE-2026-110769 (2)

IV. Related Vulnerabilities

Same product: holaOS
Same vendor: holaboss-ai
Same weakness: CWE-1188

V. Comments for CVE-2026-110769

No comments yet

Leave a comment