holaOS: Missing authorization in channel gateway connectors
Summary
holaOS through version 2026.822.1 lets any user of a connected chat platform (such as Telegram, Slack, Discord or another bot) submit tasks to the workspace agent. The channel sender check accepts all senders when the default allowFrom list is empty. An attacker who can message the bot can cause the agent to run its configured tools on the operator's machine.
Affected
- holaOS 0 through 2026.822.1
- Exposure applies when a channel connector (Telegram, Slack, Discord or similar) is enabled with an empty allowFrom list, which is the default
Fixed in
Unknown.
Workaround
- Do not run channel connectors with an empty allowFrom list; set explicit sender IDs
- Restrict the tools the workspace agent may run
- Limit the bot to a private chat or channel
- Disable channel connectors that are not needed
Exploitation
- No evidence of exploitation in the wild; not listed in KEV
- CISA SSVC: exploitation status PoC, automatable: yes
- VulDB reports no exploit available; a technical write-up by the finder exists and was not reviewed for exploit content
- EPSS 0.00292 (low)
Our recommendation
- Check whether holaOS is installed and whether any channel connector is enabled
- Set explicit allowFrom sender IDs for every connector and review the configuration after each update
- Run the agent on a dedicated machine or account without access to sensitive files or credentials
- Monitor for unexpected agent tasks and tool executions
- Watch the holaOS releases page for a fixed version and update as soon as one is available
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record mirror (VulnCheck advisory) www.vulncheck.com
- holaOS telegram.ts connector at commit 4684714 github.com
- holaOS GitHub repository github.com
- VulDB entry 420331 vuldb.com
- OpenCVE CVE-2026-110769 app.opencve.io
- Vulners CVE-2026-110769 vulners.com
- Finder write-up (HackMD) hackmd.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:45.
Original description (NVD)
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
NVD references (4)
- https://github.com/holaboss-ai/holaOS
- https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/s…
- https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default
- https://www.vulncheck.com/advisories/holaos-through-2026.822.1-missing-authorization-in-channel-gateway-conne…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.