CVE-2026-67548— taOS: Non-Admin Users Can Access System Settings and Update Actions
Quick assessment
Affected
jaylfc taOS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
taOS 是一个自托管的 AI 智能体操作系统。在 1.0.0-beta.25 版本之前，tinyagentos（taOS）将所有系统设置路由注册在一个由 APIRouter() 创建的单一实例下，且该实例未依赖管理员权限验证。因此，任何已认证用户（包括那些 is_admin 标志明确为 False 的非管理员受邀用户）均可读取完整的系统配置、覆盖配置内容、修改平台设置、触发 git 拉取操作、重新安装依赖并重启服务，以及切换所跟踪的更新分支。成功利用写操作端点将导致配置立即损坏，或对该实例上的所有用户造成拒绝服务
Possible ATT&CK Techniques 3 AI
T1070 · Indicator Removal T1499 · Endpoint Denial of Service T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-67548
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
taOS: Non-Admin Users Can Access System Settings and Update Actions
Source: CVE Program / CVE List V5
Vulnerability Description
taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-67548
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-67548
请登录查看更多情报信息。
Other References for CVE-2026-67548 (3)
-
https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.25 x_refsource_MISC
-
https://github.com/jaylfc/taOS/security/advisories/GHSA-47g9-fwwp-hrfp x_refsource_CONFIRM