holaOS Authorization Flaw Lets External Users Run Agent Tasks

holaboss-ai holaOS versions through 2026.822.1 contain a high-severity authorization flaw. The vulnerability allows external users to execute agent tasks on operator machines.

What happened

The National Vulnerability Database recorded CVE-2026-110769 with a CVSS score of 8.3, classifying it as high severity. The flaw exists in channel-gateway connectors within holaOS software up to version 2026.822.1. The issue stems from a missing authorization check in the #isAllowed function. This function accepts all senders when the default allowFrom list is empty.

Attackers who can message an operator's bot on platforms like Telegram, Slack, or Discord can exploit this. The ChannelIngress.handle process passes turns to the workspace agent. This allows the agent to run configured tools on the operator's machine. The vulnerability is categorized under CWE-1188, indicating improper handling of authorization.

Why it matters

This vulnerability bypasses standard access controls for agent tasks. Any user with access to the bot's messaging channel can trigger actions. The workspace agent executes these tasks on the operator's local environment. The flaw affects multiple popular messaging platforms, increasing the attack surface.

The source material states that the #isAllowed check accepts all senders when the default allowFrom list is empty. This condition allows ChannelIngress.handle to pass turns to the workspace agent. The agent then runs configured tools on the operator's machine. This mechanism enables unauthorized execution of tasks by any messaging-platform user.

What to watch

• Monitor for unexpected agent task executions on connected machines.
• Check logs for unusual activity from Telegram, Slack, or Discord bots.
• Verify that allowFrom lists are not empty in current configurations.
• Watch for official announcements from holaboss-ai regarding patches.

Who needs to act first

Teams should prioritize systems exposed to public or semi-public messaging channels. Check whether bots are accessible to external users without strict identity verification. Roll out configuration changes that restrict the allowFrom list to known, trusted senders. Test these changes in a controlled environment before applying them to production. Back up current configurations to allow quick rollback if issues arise. Focus on reducing exposure by limiting bot access to authorized personnel only.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: holaboss-ai

• Restrict bot access to trusted users by configuring explicit allowFrom lists in holaOS settings.
• Monitor agent task logs for unauthorized executions originating from unexpected messaging sources.
• Implement additional authentication layers at the messaging platform level to verify sender identity.
• Isolate critical operator machines from direct bot connections until a vendor fix is available.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What versions of holaOS are affected by CVE-2026-110769?

All versions of holaOS up to and including 2026.822.1 are affected by this vulnerability.

Is there a patch available for this authorization flaw?

No fix has been confirmed yet according to the provided source material.

Which messaging platforms can be used to exploit this vulnerability?

Attackers can use Telegram, Slack, Discord, or other platforms where the bot is accessible.