This vulnerability exists in the channel‑gateway connectors of holaOS version 2026.822.1 and allows any user who can send a message to the operator’s messaging bot (Telegram, Slack, Discord, etc.) to submit agent tasks. The connector’s authorization check, #isAllowed, accepts all senders when the default allowFrom list is empty, so an attacker can direct the operator’s workspace agent to run arbitrary configured tools or scripts on the operator’s machine. The result is remote code execution on the operator’s host, compromising confidentiality, integrity, and availability of that system.

Affected by this issue are deployments of holaboss‑ai’s holaOS up to and including version 2026.822.1. Any installation that has the channel-gateway feature enabled and has not yet applied a fix that enforces proper sender authorization is susceptible. If a specific installation uses the default, empty allowFrom list for any of the supported messaging platforms, it is directly vulnerable.

The CVSS score of 8.3 classifies this flaw as HIGH severity, indicating a significant threat. The EPSS score is not available, so the exact likelihood of exploitation is uncertain, but the vulnerability is listed as not yet in the CISA KEV catalog, suggesting no known public exploits have been reported. An attacker would need access to the operator’s messaging platform account or sufficient permission to send messages to the bot, which is often publicly reachable. Consequently, the risk is high for any exposed operator bot and for any system that relies on the channel‑gateway connectors without a robust allowFrom configuration.