CVE-2026-110768

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

EUVD-2026-101568

holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed in allowFrom can submit turns to the bound workspace agent,...

CVE-2026-110768

Versions of holaOS through 2026.822.1 are vulnerable to an authorization bypass in the channel-gateway Telegram connector . The flaw exists because the connector authorizes senders based on mutable usernames instead of using unique numeric IDs. An attacker can register a released username that is...