CVE-2026-110769 in holaOS
Summary
by MITRE • 10/14/2026
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified in holaOS versions up through 2026.822.1 represents a critical failure in access control mechanisms within the channel-gateway connectors component of the system. This flaw specifically affects how incoming messages from various messaging platforms, such as Telegram, Slack, and Discord, are processed before being executed by workspace agents. The core technical issue lies in the logic governing the #isAllowed authorization check. In a secure implementation, this function should validate that the sender of a message possesses the necessary privileges to request specific agent tasks or tool executions. However, due to a configuration-dependent logical error, when the default allowFrom list is empty, the system incorrectly interprets this state as an explicit permission grant rather than a denial of access. Consequently, any user capable of sending a direct message to the operator's bot on these supported platforms bypasses authentication and authorization checks entirely.
This misconfiguration allows unauthenticated or unauthorized actors to submit arbitrary agent tasks directly to the workspace agent. The operational impact is severe because it enables remote code execution capabilities under the context of the holaOS environment. Attackers can leverage this flaw to have ChannelIngress.handle pass turns to the workspace agent, which then proceeds to run configured tools on the operator's machine. This effectively grants external users control over system operations that should be restricted to authorized administrators or specific internal workflows. The ability to execute arbitrary commands poses significant risks including data exfiltration, lateral movement within connected networks, and potential compromise of sensitive infrastructure managed by the holaOS instance.
From a classification perspective, this vulnerability aligns with CWE-287, which denotes Improper Authentication, as well as CWE-862, Missing Authorization. The attack vector is consistent with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use system tools to execute commands on a target host. Furthermore, the exploitation of messaging platform bots places this within the context of supply chain or integration-based attacks described in techniques such as T1647 Potential Privilege Escalation via Trusted Applications if the agent has elevated privileges. The vulnerability highlights the dangers of relying on default configurations that may inadvertently open security holes when specific allow lists are not explicitly populated with trusted identifiers.
Mitigation strategies must focus on correcting the authorization logic within the channel-gateway connectors. Developers should ensure that an empty allowFrom list is treated as a deny-all state rather than an accept-all state, enforcing explicit whitelisting of authorized senders for all agent task submissions. Additionally, implementing strict input validation and rate limiting can help mitigate abuse even if configuration errors occur. Organizations running affected versions should immediately update to patched releases where this logic has been corrected. Until patches are applied, administrators should restrict bot accessibility by configuring firewalls or network policies to block external access to the messaging endpoints until proper authorization controls are verified in production environments.