Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
CVE-2026-110768
holaboss-ai holaOS — holaOS through 2026.822.1 Authorization Bypass via Telegram Connector Username Allowlist
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV
N L P N N L L N 6.3 .0022 11.7 —
AFFECTED
Product Versions Fixed
holaOS unspecified —
TIMELINE
Oct 14 EXPLOIT PUBLISHED — CVE-2026-110768 (holaboss-ai holaOS). Public exploit reference added.
Oct 14 Reserved by VulnCheck
Oct 14 Published (CNA: VulnCheck)
Description
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent, which runs configured tools on the operator's machine.
Lifecycle
Complete event history — 3 events, chronological
| Date | Event | Detail |
|---|
| October 14, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-110768 (holaboss-ai holaOS). Public exploit reference added. |
| October 14, 2026 | Reserved | Reserved by VulnCheck |
| October 14, 2026 | Published | Published (CNA: VulnCheck) |
Affected
Affected products and packages — 1 row
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| holaboss-ai | holaOS | — | — | — |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-110768 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
