Authorization Bypass in holaOS Channel Gateway

holaOS versions through 2026.822.1 contain a significant authorization flaw within their channel-gateway connectors. The vulnerability arises because the #isAllowed function fails to enforce sender validation when the default 'allowFrom' configuration list is empty, defaulting to an insecure state that accepts all incoming messages.

Defenders should note that this vulnerability allows any user capable of sending a message to the operator's integrated messaging platform (e.g., Telegram, Slack, or Discord) to interact with the ChannelIngress.handle component. By bypassing access controls, remote attackers can submit agent tasks that are processed by the workspace agent. This effectively enables unauthorized users to execute configured tools on the operator's machine, potentially leading to unauthorized data access or local command execution depending on the toolset available to the agent.

Impact

Successful exploitation allows remote, unauthenticated attackers to execute agent tasks on host machines where holaOS is deployed. This impacts the integrity of automated workflows and the security of the host environment, specifically in environments relying on integration with third-party messaging bots.

Recommendation

• Upgrade holaOS to a version beyond 2026.822.1 once a patch is available.
• Audit existing holaOS configurations to ensure the 'allowFrom' list is explicitly populated, preventing the insecure default behavior.
• Monitor ingress traffic to messaging bot integrations for unexpected or anomalous agent task submissions from unauthorized users.