Authorization Bypass in holaOS Telegram Connector
CVE-2026-110768

6.3MEDIUM

Key Information:

Vendor

Holaboss-ai

Status
Holaos
Vendor
CVE Published:
14 October 2026

Badges

👾 Exploit Exists

What is CVE-2026-110768?

The holaOS product, up to version 2026.822.1, has a security flaw in its Telegram connector that allows an authorization bypass. This vulnerability enables attackers to exploit mutable usernames for authentication, rather than solely relying on numeric IDs, leading to unauthorized access. Attackers who register a valid username included in the allowlist can submit commands to the workspace agent, potentially allowing them to execute arbitrary tools on the operational machine. Users must adopt immediate security measures to mitigate risks associated with this vulnerability.

Affected Version(s)

holaOS 0 <= 2026.822.1

References

https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-a...
technical-descriptionexploit
https://github.com/holaboss-ai/holaOS/blob/4684714ee13379...
technical-description
https://github.com/holaboss-ai/holaOS
product

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

hieuPenguinnn
.