CVE-2026-110769: holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Operators whose holaOS deployment uses channel-gateway connectors for Telegram, Slack, Discord, or another messaging platform are exposed if the connector's allowFrom list is left empty. Any user able to message the operator's bot on that platform can submit tasks to the workspace agent.
Does this affect the default configuration?
Yes. The authorization check accepts all senders when the allowFrom list has its default empty value, so an unconfigured sender allowlist permits messages from any sender.
What does an attacker need to exploit it?
The attacker needs only the ability to send a message to the operator's connected bot or messaging endpoint. No authentication, prior privileges, or user interaction is required.
What is the impact of a successful exploit?
An attacker can cause ChannelIngress.handle to pass tasks to the workspace agent. Those tasks can invoke tools configured to run on the operator's machine, with confidentiality, integrity, and availability impact depending on those tools.
What can operators do if they cannot patch immediately?
Configure a non-empty allowFrom list for every affected channel-gateway connector so that only approved sender identities can submit agent tasks. Restricting bot access to trusted users also reduces exposure.