CVE-2026-110768 holaboss-ai CVE debrief

Who should care

Defenders responsible for holaOS systems, particularly those using the Telegram connector, should assess exposure and prioritize patching or mitigation. This includes operators of affected systems, security teams, and vulnerability management teams. They should verify the allowlist of authorized senders in the Telegram connector and review system logs for suspicious activity related to the channel-gateway.

Why it matters

CVE-2026-110768 is an authorization bypass vulnerability in holaOS through version 2026.822.1, allowing potential unauthorized actions on the operator's machine. Defenders should prioritize verifying affected versions and applying patches or mitigations.

• Potential unauthorized actions on the operator's machine
• Possible exploitation by attackers who register released usernames
• Need for verification of affected versions and patching
• Potential disruption of service if exploited

Technical summary

The vulnerability is caused by the Telegram connector in the channel-gateway authorizing senders by mutable username instead of numeric id. This allows attackers to submit turns to the bound workspace agent, potentially leading to unauthorized actions on the operator's machine. The vulnerability affects holaOS through version 2026.822.1 and can be exploited by registering a released username listed in allowFrom. Defenders should prioritize verifying affected versions and applying patches or mitigations to prevent exploitation.

Defensive priority

Defenders should prioritize verifying the affected versions of holaOS and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify the version of holaOS and check if it is affected by the vulnerability
• Apply patches or mitigations provided by the vendor to prevent exploitation
• Monitor the system for potential suspicious activity
• Review and update the allowlist of authorized senders in the Telegram connector
• Perform vulnerability scanning to identify potentially affected systems
• Review system logs for suspicious activity related to the channel-gateway
• Implement compensating controls for exposed systems while remediation is scheduled

Evidence notes

The CVE record and source item provide details about the vulnerability in holaOS through version 2026.822.1, but there is limited information about potential exploitation or affected systems. Defenders should verify the allowlist of authorized senders in the Telegram connector and review system logs for suspicious activity related to the channel-gateway. Evidence is limited to CVE and source item descriptions, so further verification is required.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.