{"id":"CVE-2026-67547","kind":"vulnerability","aliases":["CVE-2026-67547"],"related":[],"title":"taOS: any logged-in user can run Python code on the host","description":"taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run([\"python3\", \"-c\", code]) — without performing any admin role check, skill ownership check, or agent assignment verification. Any authenticated non-admin user can supply attacker-controlled Python code in the request body and have it executed as the taOS backend process user on the host, achieving full remote code execution with no privilege escalation required beyond a valid (non-admin) session. This issue has been patched in version 1.0.0-beta.23.","summary":"taOS, a self-hosted AI agent OS, lets any authenticated non-admin user call the skill execution endpoint and run arbitrary Python through its code_exec skill. The code runs as the taOS backend process user, so an attacker gets full remote code execution on the host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","self-hosted","taos"],"not_affected_if":["version-1.0.0-beta.23-or-later"],"how_to_check":"- Check the taOS version the instance runs; versions before `1.0.0-beta.23` are affected.\n- Look for the endpoint `POST /api/skill-exec/{skill_id}/call` on the instance and whether non-admin accounts can reach it.","fix":"- taOS: upgrade to `1.0.0-beta.23` or later.","status":"open","published_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:15+00:00","updated_at":"2026-11-11T22:31:15+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-11T22:31:15Z","model":"claude-haiku-5-5","output":{"fix":"- taOS: upgrade to `1.0.0-beta.23` or later.","reach":"network","title":"taOS: any logged-in user can run Python code on the host","impact":"high","summary":"taOS, a self-hosted AI agent OS, lets any authenticated non-admin user call the skill execution endpoint and run arbitrary Python through its code_exec skill. The code runs as the taOS backend process user, so an attacker gets full remote code execution on the host.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["self-hosted","taos","ai-agents"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"code runs as the taOS backend user on the host","analyst_note":"Confirm the affected version range and fix details from the linked vendor advisory and release notes, which the sources here did not state beyond the patched version.","how_to_check":"- Check the taOS version the instance runs; versions before `1.0.0-beta.23` are affected.\n- Look for the endpoint `POST /api/skill-exec/{skill_id}/call` on the instance and whether non-admin accounts can reach it.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-1.0.0-beta.23-or-later"],"who_is_affected":"Any team running a self-hosted taOS instance before 1.0.0-beta.23 where user accounts exist beyond the admin. Exposure depends on whether the code_exec skill and the skill-exec endpoint are reachable by ordinary logged-in users, which the sources do not detail further. Instances with only admin accounts are less exposed, though the sources do not say that is sufficient.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000785,"input_tokens":4705,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-67547':16A,19A '/api/skill-exec':95C '/call':98C '1.0.0':91C,188C 'achiev':164C 'admin':43B,124C,138C,179C 'agent':22B,36B,86C,131C 'ai':21B,24B,35B,85C 'ai-ag':20B 'ai-tool':23B 'arbitrari':52B,114C 'assign':132C 'attack':70B,143C 'attacker-control':142C 'authent':40B,135C 'backend':65B,158C 'beta.23':92C,189C 'beyond':174C 'bodi':150C 'built':104C 'built-in':103C 'c':119C 'call':45B 'check':126C,129C 'code':10A,56B,60B,74B,109C,120C,146C,167C 'control':144C 'cve':14A,17A 'endpoint':49B,99C 'escal':172C 'exec':57B,110C 'execut':48B,75B,102C,154C,168C 'full':72B,165C 'get':71B 'host':13A,28B,34B,78B,84C,163C 'id':97C 'includ':107C 'issu':182C 'let':38B 'log':4A 'logged-in':3A 'non':42B,137C,178C 'non-admin':41B,136C,177C 'os':37B,87C 'ownership':128C 'patch':185C 'perform':122C 'post':94C 'prior':88C 'privileg':171C 'process':66B,159C 'python':9A,53B,115C,145C 'python3':118C 'remot':73B,166C 'request':149C 'requir':173C 'role':125C 'run':8A,51B,61B,113C 'self':27B,33B,83C 'self-host':26B,32B,82C 'session':180C 'skill':47B,58B,96C,106C,111C,127C 'subprocess.run':117C 'suppli':141C 'tao':1A,29B,30B,64B,79C,101C,157C 'tool':25B 'user':6A,44B,67B,139C,160C 'valid':176C 'verif':133C 'version':90C,187C 'via':116C 'without':121C","nicknames":[],"mitigations":[],"who_affected":"Any team running a self-hosted taOS instance before 1.0.0-beta.23 where user accounts exist beyond the admin. Exposure depends on whether the code_exec skill and the skill-exec endpoint are reachable by ordinary logged-in users, which the sources do not detail further. Instances with only admin accounts are less exposed, though the sources do not say that is sufficient.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","high","selfhosted","taos"],"campaign_type":null,"search_a":"'-2026':15A,18A '-67547':16A,19A 'code':10A 'cve':14A,17A 'host':13A 'log':4A 'logged-in':3A 'python':9A 'run':8A 'tao':1A 'user':6A","search_b":"'admin':43B 'agent':22B,36B 'ai':21B,24B,35B 'ai-ag':20B 'ai-tool':23B 'arbitrari':52B 'attack':70B 'authent':40B 'backend':65B 'call':45B 'code':56B,60B,74B 'endpoint':49B 'exec':57B 'execut':48B,75B 'full':72B 'get':71B 'host':28B,34B,78B 'let':38B 'non':42B 'non-admin':41B 'os':37B 'process':66B 'python':53B 'remot':73B 'run':51B,61B 'self':27B,33B 'self-host':26B,32B 'skill':47B,58B 'tao':29B,30B,64B 'tool':25B 'user':44B,67B","search_c":"'/api/skill-exec':95C '/call':98C '1.0.0':91C,188C 'achiev':164C 'admin':124C,138C,179C 'agent':86C,131C 'ai':85C 'arbitrari':114C 'assign':132C 'attack':143C 'attacker-control':142C 'authent':135C 'backend':158C 'beta.23':92C,189C 'beyond':174C 'bodi':150C 'built':104C 'built-in':103C 'c':119C 'check':126C,129C 'code':109C,120C,146C,167C 'control':144C 'endpoint':99C 'escal':172C 'exec':110C 'execut':102C,154C,168C 'full':165C 'host':84C,163C 'id':97C 'includ':107C 'issu':182C 'non':137C,178C 'non-admin':136C,177C 'os':87C 'ownership':128C 'patch':185C 'perform':122C 'post':94C 'prior':88C 'privileg':171C 'process':159C 'python':115C,145C 'python3':118C 'remot':166C 'request':149C 'requir':173C 'role':125C 'run':113C 'self':83C 'self-host':82C 'session':180C 'skill':96C,106C,111C,127C 'subprocess.run':117C 'suppli':141C 'tao':79C,101C,157C 'user':139C,160C 'valid':176C 'verif':133C 'version':90C,187C 'via':116C 'without':121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T12:10:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67547","severity":null,"published_at":"2026-11-11T22:17:29+00:00","modified_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129458,"url":"https://github.com/jaylfc/taOS/commit/8998d85190424d5e843880b4ca256e79b653a304","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129459,"url":"https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.23","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129460,"url":"https://github.com/jaylfc/taOS/security/advisories/GHSA-h24f-gp4c-8qjm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T12:10:04+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}