Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-110768

holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Holaboss-ai
Products
Holaos
CVE-2026-110769

holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Holaboss-ai
Products
Holaos