What happened
Verified via NVD REST API (CVE-2026-110769 published 2026-10-14, CVSS 8.6 v3.1 / 8.3 v4.0; CVE-2026-110768 CVSS 4.8). The channel-gateway connectors intended to gate who can drive the local agent fail open with empty allowlists and key on spoofable usernames, so arbitrary remote users can steer the agent to act on host infrastructure.
Why it matters
This is a direct agent-control vulnerability: an attacker who can send a chat message gains the ability to make a personal AI agent run tools (shell, file ops, browser) on the operator's machine — effectively remote agent-driven execution, a class of agentic-application vulnerability where the messaging surface is the entry point. Users must populate allowFrom/numeric-id lists or disable network-facing channel connectors.
Attack vector
Remote, no auth: an attacker messages the operator's Telegram/Slack/Discord bot; ChannelIngress.handle passes the turn to the bound workspace agent, which executes the configured tools on the operator's machine. Because the default allowFrom list is empty, the #isAllowed check accepts every sender (CWE-1188). CVE-2026-110768 additionally authorizes by mutable username instead of numeric id (CWE-290).
Affected systems
holaOS through 2026.822.1
Mitigation
Upgrade holaOS and configure the allowFrom sender list explicitly (numeric Telegram ids, not usernames); disable channel connectors not in active use; treat any exposed bot as an attack surface. VulnCheck advisories 110769/110768.