holaOS Channel Gateway CVE-2026-110768

Exploitation requires the holaOS Telegram connector to be in use with an allowFrom allowlist that authorizes senders by mutable Telegram username, AND requires one of those allowlisted usernames to have been released/relinquished by its original owner so the attacker can claim it on Telegram. The attacker then submits turns to the bound workspace agent. LIMITING FACTORS: the precondition (an authorized username becoming available for re-registration) is outside attacker control and makes this opportunistic/targeted rather than reliably repeatable (reflected as AT:P); the resulting impact is strictly bounded by which tools the operator has configured for the agent; installations that pin authorization to the numeric Telegram id instead of username are not affected.

This is a medium-severity authorization bypass (CVSS 4.0 base 6.3) whose real-world priority is LOW-to-MODERATE and almost certainly targeted rather than opportunistic. The vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N is network-reachable and unauthenticated at the holaOS layer, but the AT:P (Attack Requirements: Present) metric is decisive - exploitation is gated on a specific, out-of-attacker-control precondition: a username already listed in the operator's allowFrom allowlist must first be released/abandoned so the attacker can re-register it on Telegram. No EPSS score was provided, there is NO CISA KEV listing (not actively exploited), and no public exploit code is flagged - only a third-party technical writeup (hackmd) and a precise source-line reference exist. Key signals are therefore consistent and all point DOWN: low impact metrics (VC:L/VI:L/VA:N), a non-trivial attack requirement, and an obscure affected product. NOTABLE TENSION: the description says the agent 'runs configured tools on the operator's machine,' which sounds like it could approach code execution, yet the official vector rates confidentiality/integrity impact only Low and availability None - because actual impact is bounded by whichever tools the operator has configured. Treat the true impact as deployment-dependent and verify against the specific tool configuration before rating higher.

An attacker enumerates (or learns from the operator's public config) a Telegram username listed in a holaOS allowFrom allowlist, waits for or notices that it has been relinquished by its original owner, and registers that username on their own Telegram account. They then message the bot and submit turns to the bound workspace agent, which trusts the mutable username and executes the operator's configured tools on the operator's machine. No public exploit code is identified, though a third-party technical writeup details the root cause in telegram.ts.