EUVD-2026-101569
GHSA-v8pm-qrjg-7q78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate operator's reachable chat bot
-
DeliverySend crafted task message to bot
-
ExploitEmpty allowFrom bypasses #isAllowed
-
ExecutionChannelIngress passes turn to agent
-
ImpactConfigured tools execute on operator machine
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V13 - Configuration Secure default settings
|
| Exploitation Conditions | Requires a holaOS channel-gateway connector (Telegram, Slack, Discord, or similar bot) to be configured AND the connector's allowFrom allowlist to be left at its empty default - the condition that makes #isAllowed accept every sender. The attacker must be able to reach and send messages to that specific operator bot (reflected as AT:P in the CVSS vector). Exploitation is fully unauthenticated at the agent level (PR:N) and needs no user interaction. Limiting factors: if the operator populates allowFrom with permitted senders the flaw does not apply, and no public exploit code is confirmed; impact scope is bounded to the tools the operator has configured for the workspace agent. |
| Impact | This is a genuine high-priority issue for anyone actually running holaOS with a chat connector, not a paper-high CVSS. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VI:H) reflects an unauthenticated, network-reachable path that yields high integrity impact - arbitrary configured tools executing on the operator's machine - which the description fully supports. The one moderating signal is AT:P (an attack requirement): the attacker must be able to reach and message the operator's specific bot, so exploitation is not indiscriminately internet-scannable. No EPSS score, no CISA KEV entry, and no confirmed public exploit code are present in the input, so there is no evidence of active or at-scale exploitation; a detailed third-party technical writeup (hackmd) and the VulnCheck advisory do exist, lowering the barrier to reproduce. Signals are broadly consistent - the only conflict is the 'Information Disclosure' tag, which understates the true impact: VC is only Low while VI is High, i.e. this is an authorization/execution flaw, not primarily a disclosure flaw. Net: treat as a real, actively-fixable priority for holaOS deployments, tempered by the product's small footprint and the requirement to reach the operator's bot. |
| Exploit ScenarioDerived | An operator runs holaOS wired to a Telegram/Slack/Discord bot but leaves the allowFrom list at its empty default. Because #isAllowed accepts all senders when allowFrom is empty, any user who can message that bot gets their turn passed by ChannelIngress.handle to the workspace agent, which then runs the operator's configured tools on the operator's machine. No vendor exploit is confirmed, but a public technical writeup describes the root cause in detail, making reproduction straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Missing authorization in holaOS channel-gateway connectors (Telegram, Slack, Discord, and similar) through 2026.822.1 allows any unauthenticated messaging-platform user who can reach an operator's configured bot to submit agent tasks, because the #isAllowed check treats an empty default allowFrom list as permitting all senders and ChannelIngress.handle then forwards those turns to the workspace agent, which executes configured tools on the operator's machine. Exploitation requires the connector to be configured and allowFrom left at its empty default (attack requirements present, AT:P) and needs no user interaction; no public exploit code is identified at time of analysis, but the CVSS 4.0 base score of 8.3 reflects high integrity impact (VI:H) with low confidentiality and availability impact. This is a high-priority issue for operators who actually run holaOS with a chat connector and have not populated an explicit sender allowlist.
RemediationAI
No vendor-released patch is identified at time of analysis; the available references point to the vulnerable source and a third-party advisory rather than a fixed release, so operators must apply compensating controls. The most direct mitigation is to populate each enabled connector's allowFrom allowlist with the exact platform sender IDs permitted to submit agent tasks, which restores the intended authorization boundary, with the trade-off that it breaks legitimate multi-user or shared-bot workflows unless every expected sender is enumerated. If a connector does not need to accept inbound messages, disable it entirely and remove or rotate the bot token, accepting the loss of that integration as the side effect. Additionally, minimize blast radius by running the workspace agent with only the minimum tool set and least-privilege host permissions required, and treat any messages reaching the bot as potentially hostile until an allowlist is in place; these measures reduce impact but do not by themselves fix the missing authorization check. Monitor holaOS releases and the advisory at https://www.vulncheck.com/advisories/holaos-through-2026.822.1-missing-authorization-in-channel-gateway-connectors for a vendor fix, and review https://github.com/holaboss-ai/holaOS for updates; no public exploit code is confirmed, so prioritize remediation based on whether the connector and empty-allowFrom condition actually exist in your deployment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is rooted in CWE-1188, Insecure Default Initialization of Resource, where the channel-gateway's #isAllowed authorization check returns true for every sender when the connector's allowFrom configuration is empty instead of defaulting to deny. In the affected code, visible in the Telegram connector at runtime/channel-gateway/src/connectors/telegram.ts line 488, a default-empty allowFrom list causes the check to accept all inbound messages, and ChannelIngress.handle subsequently passes the resulting turn to the workspace agent, which can invoke the tools configured for that agent on the operator's host. The underlying technology is a multi-connector messaging gateway that bridges chat platforms such as Telegram, Slack, and Discord to an autonomous agent runtime; the authorization boundary is therefore the gateway's sender check, and its insecure default initialization turns any reachable bot into an unauthenticated task-submission endpoint. The CVSS 4.0 vector reflects network reachability (AV:N), no privileges required (PR:N), no user interaction (UI:N), and present attack requirements (AT:P) tied to the connector being configured with an empty allowlist; the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) matches this reading and bounds impact to the tools the operator has actually configured.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
Empty default allowFrom accepts all senders so PR:N; network messaging vector AV:N/AC:L; primary impact is arbitrary tool execution (I:H) with limited data exposure and availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
Executive ViewAI
holaOS channel-gateway connectors (Telegram, Slack, Discord, and similar) through 2026.822.1 contain a missing authorization flaw that can let a messaging-platform sender submit agent tasks when a connector is enabled and its allowFrom list is left empty, potentially causing the workspace agent to execute configured tools on the operator’s machine. This is a high-priority issue for organizations that run holaOS with chat connectors and have not set an explicit sender allowlist, because unauthorized task execution can alter data and trigger actions with high integrity impact. No public exploit identified at time of analysis, and No vendor-released patch identified at time of analysis, so leadership should treat exposed deployments as requiring urgent configuration mitigation.
No vendor-released patch identified at time of analysis. Populate explicit allowFrom allowlists for all holaOS channel-gateway connectors (Telegram, Slack, Discord, and similar); disable unused connectors; restrict bot reachability to trusted users and channels; enforce least privilege on configured agent tools; and monitor agent task execution logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB