CVE-2026-110768Published
holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-110768 · Microsoft / collected KEV context
cve-program · CVE-2026-110768
- https://hackmd.io/@hieuPenguinnn/holaos-channel-gateway-allow-all-sender-default
- https://github.com/holaboss-ai/holaOS/blob/4684714ee133794cdbb86630e42b7d93447fb2e2/runtime/channel-gateway/src/connectors/telegram.ts#L491
- https://github.com/holaboss-ai/holaOS
- https://www.vulncheck.com/advisories/holaos-through-2026.822.1-authorization-bypass-via-telegram-connector-username-allowlist
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.