CVE-2026-110768
4.8 MEDIUMpublic exploit availablePublished 2026-10-14 · Updated 2026-10-15
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-290
Public exploit & PoC references
All references
- https://github.com/holaboss-ai/holaOS
- https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/src/connectors/telegram.ts#L491
- https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default
- https://www.vulncheck.com/advisories/holaos-through-2026.822.1-authorization-bypass-via-telegram-connector-username-allowlist
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2023-54411PoC
- HIGHCVE-2026-100390PoC
- HIGHCVE-2026-101280
- HIGHCVE-2026-102161
- CRITICALCVE-2026-102764
- CRITICALCVE-2026-102946PoC
- MEDIUMCVE-2026-103347
- MEDIUMCVE-2026-103397PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.