Authentication Bypass in Reachy Mini Robot Management Daemon

CVE-2026-96455

What is CVE-2026-96455?

The Reachy Mini daemon lacks proper authentication measures for its HTTP API, specifically at the app installation endpoint. This vulnerability allows any user on the local network to install arbitrary code on the robot by sending a request to the POST /apps/install endpoint. Without authentication, attackers can exploit this weakness to execute unverified code contained in Hugging Face Spaces. While version 1.8.2 introduced stricter CORS policies to mitigate browser-based attacks, this does not remediate the underlying flaw, as the vulnerability allows direct HTTP requests from any host on the same LAN, which completely bypasses CORS checks. The daemon's configuration can further amplify the risk, as it binds to 0.0.0.0 in wireless mode, enabling potentially unauthorized access to any device connected to the network.

References