CVE-2026-67547: taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime
taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skillid}/call endpoint in taOS executes built-in skills — including the codeexec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
taOSto a version that resolves this vulnerability.Fixed in 1.0.0-beta.23
Event History
Frequently Asked Questions
Which deployments are affected?
taOS versions before 1.0.0-beta.23 are affected where an authenticated non-admin user can reach the POST /api/skill-exec/{skill_id}/call endpoint. The issue involves built-in skills, including code_exec.
What does an attacker need to exploit this issue?
An attacker needs a valid authenticated non-admin session and access to the vulnerable endpoint. No administrator role, skill ownership, agent assignment, or user interaction is required.
What level of access can successful exploitation provide?
Attacker-supplied Python is executed by the taOS backend process through the code_exec skill. This provides remote code execution with the privileges of the backend process user.
How can I remediate the issue?
Upgrade taOS to version 1.0.0-beta.23, which includes the patch. Until upgrading, restrict access to the affected endpoint and prevent non-admin users from reaching it.
How can I determine whether a system may have been exposed?
Check whether the deployment runs a version earlier than 1.0.0-beta.23 and whether non-admin accounts could access POST /api/skill-exec/{skill_id}/call. Review requests to that endpoint for calls to the code_exec skill containing Python code.