CVE-2026-67547 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
taOS, a self-hosted AI agent OS, lets any authenticated non-admin user call the skill execution endpoint and run arbitrary Python through its code_exec skill. The code runs as the taOS backend process user, so an attacker gets full remote code execution on the host.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any team running a self-hosted taOS instance before 1.0.0-beta.23 where user accounts exist beyond the admin. Exposure depends on whether the code_exec skill and the skill-exec endpoint are reachable by ordinary logged-in users, which the sources do not detail further. Instances with only admin accounts are less exposed, though the sources do not say that is sufficient.
Not affected if version-1.0.0-beta.23-or-later
Who cares ai-agents, self-hosted, taos
1.0.0-beta.23 are affected.POST /api/skill-exec/{skill_id}/call on the instance and whether non-admin accounts can reach it.1.0.0-beta.23 or later.taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.