TAOS · CVE-2026-67548 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
taOS is a self-hosted AI agent OS whose system settings routes lack any admin check. Any authenticated user, including non-admin invited users, can read the full configuration, overwrite it, and trigger an update and service restart, causing denial of service for everyone on the instance.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running a self-hosted taOS instance with more than one account, including invited non-admin users. The flaw lies in the settings routes, so any authenticated account can reach them; single-user instances where only the admin has an account are exposed only through that admin account.
Not affected if managed-hosting, single-admin-account
Who cares ai-agents, self-hosted, taos
1.0.0-beta.251.0.0-beta.25taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.