CVE-2026-110768 Details
Description
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
A vulnerability allowing authorization bypass has been identified in holaOS versions through 2026.822.1. This issue resides within the channel-gateway Telegram connector, which incorrectly authorizes users based on mutable usernames instead of their numeric IDs. As a result, attackers can exploit this flaw by registering a username listed in the allowFrom configuration to send commands to the associated workspace agent. The agent executes these commands using tools available on the operator's machine.
Update the holaOS configuration to include specific sender IDs in the allowFrom list, replacing any username entries with the corresponding numeric IDs. This change should be applied to the Telegram, Slack, and Discord connectors.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| holaOS | <= 2026.822.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |