Vulnerabilidades de Holaboss-ai

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Holaboss-ai: 2 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-110769 Alta · 8.6 CWE-1188 14/10/2026

holaOS through 2026.822.1 Missing Authorization in Channel-Gateway Connectors

holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowFrom list is empty. Attackers who can message the operator's Telegram, Slack, Discord, or other bot can have ChannelIngress.handle pass turns to the workspace agent, running configured tools on the operator's machine.

CVE-2026-110768 Média · 4.8 CWE-290 14/10/2026

holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.