Holaboss-ai vulnerabilities
Published CVEs affecting Holaboss-ai products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-110769
High · 8.6
CWE-1188 Oct 14, 2026
holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.
CVE-2026-110768
Medium · 4.8
CWE-290 Oct 14, 2026
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.