CVE-2026-110768
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
| CWE | CWE-290 |
| Vendor | holaboss-ai |
| Product | holaos |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for holaboss-ai holaos
Be the first to know when new medium vulnerabilities affecting holaboss-ai holaos are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
holaboss-ai / holaOS
0 ≤ 2026.822.1
References
hackmd.io: https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default github.com: https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/src/connectors/telegram.ts#L491 github.com: https://github.com/holaboss-ai/holaOS vulncheck.com: https://www.vulncheck.com/advisories/holaos-through-2026.822.1-authorization-bypass-via-telegram-connector-username-allowlist
Credits
hieuPenguinnn