CVE-2026-110768: holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the channel-gateway Telegram connector are exposed when their allowFrom configuration contains a Telegram username that has been released and can be registered by another account. An attacker does not need prior privileges if they can register that listed username.
What can an attacker do after bypassing the allowlist?
The attacker can submit turns to the workspace agent bound to the Telegram connector. That agent runs configured tools on the operator's machine, so the practical impact depends on the tools configured for that agent.
How can I determine whether my deployment may already be vulnerable?
Review the Telegram connector's allowFrom entries and identify entries that authorize users by username rather than numeric Telegram ID. Any listed username that is no longer controlled by its intended owner could be registered by an attacker.
What mitigation is indicated if an update cannot be applied immediately?
Remove or avoid username-based Telegram allowFrom entries and restrict authorization to numeric Telegram IDs. Also ensure that any usernames currently relied on remain controlled by their intended owners.