Configuration Management Flaw in taOS by jaylfc

CVE-2026-67548

What is CVE-2026-67548?

taOS, a self-hosted AI agent operating system, suffers from a significant flaw in its configuration management. Prior to version 1.0.0-beta.25, the secure registration of system settings was compromised as it allowed any authenticated user, including those without admin privileges, to access and modify critical system settings via a single API instance without proper authorization. This oversight permits the alteration of platform settings, execution of potentially harmful commands such as a git pull and service restart, and even the ability to switch update branches. The consequences of exploiting these write endpoints can lead to immediate configuration corruption and denial of service for all instance users. Users are urged to upgrade to the patched version 1.0.0-beta.25 to mitigate these risks.

References