AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-10-14T18:47:52.880Z and has not been modified since then. The vulnerability allows unauthorized users to submit agent tasks in holaOS channel-gateway connectors, potentially leading to unauthorized access or disruption of service. The #isAllowed check accepts all senders when the default allowFrom list [truncated]
CVE-2026-110768 is an authorization bypass vulnerability in holaOS through version 2026.822.1. The vulnerability is located in the Telegram connector of the channel-gateway, where senders are authorized by mutable username instead of numeric id. This allows attackers who register a released username listed in allowFrom to submit turns to the bound workspace agent, which runs configured tools on the operat [truncated]
