{"id":"CVE-2026-67548","kind":"vulnerability","aliases":["CVE-2026-67548"],"related":[],"title":"taOS: any logged-in user can read and change system settings","description":"taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos (taOS) registers all system settings routes under a single APIRouter() instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose is_admin flag is explicitly False—can read the full system configuration, overwrite it, modify platform settings, trigger a git pull + dependency reinstall + service restart, and switch the tracked update branch. Successful exploitation of the write endpoints causes immediate configuration corruption or a denial of service for all users on the instance from a low-privileged account. This issue has been patched in version 1.0.0-beta.25.","summary":"taOS is a self-hosted AI agent OS whose system settings routes lack any admin check. Any authenticated user, including non-admin invited users, can read the full configuration, overwrite it, and trigger an update and service restart, causing denial of service for everyone on the instance.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"taOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-agents","ai-tooling","self-hosted","taos"],"not_affected_if":["managed-hosting","single-admin-account"],"how_to_check":"- Check the installed taOS version and whether it is below `1.0.0-beta.25`\n- Confirm whether non-admin invited accounts exist on the instance","fix":"- taOS: upgrade to `1.0.0-beta.25`","status":"open","published_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:31:33+00:00","updated_at":"2026-11-11T22:31:33+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-11T22:31:33Z","model":"claude-haiku-5-5","output":{"fix":"- taOS: upgrade to `1.0.0-beta.25`","reach":"network","title":"taOS: any logged-in user can read and change system settings","impact":"high","summary":"taOS is a self-hosted AI agent OS whose system settings routes lack any admin check. Any authenticated user, including non-admin invited users, can read the full configuration, overwrite it, and trigger an update and service restart, causing denial of service for everyone on the instance.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["taos","self-hosted","ai-agents"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"low-privileged account corrupts configuration and takes the instance down","analyst_note":"","how_to_check":"- Check the installed taOS version and whether it is below `1.0.0-beta.25`\n- Confirm whether non-admin invited accounts exist on the instance","plain_action":"","product_name":"taOS","needs_analyst":false,"not_affected_if":["managed-hosting","single-admin-account"],"who_is_affected":"Teams running a self-hosted taOS instance with more than one account, including invited non-admin users. The flaw lies in the settings routes, so any authenticated account can reach them; single-user instances where only the admin has an account are exposed only through that admin account.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4701,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-67548':15A,18A '1.0.0':91C,186C 'account':178C 'admin':45B,53B,108C,117C,122C 'agent':22B,37B,86C 'ai':21B,24B,36B,85C 'ai-ag':20B 'ai-tool':23B 'apirout':103C 'authent':48B,112C 'author':109C 'beta.25':92C,187C 'branch':151C 'caus':70B,158C 'chang':10A 'check':46B 'configur':60B,132C,160C 'corrupt':161C 'creat':105C 'cve':13A,16A 'denial':71B,164C 'depend':110C,142C 'endpoint':157C 'everyon':75B 'explicit':125C 'exploit':153C 'fals':126C 'flag':123C 'full':59B,130C 'git':140C 'host':28B,35B,84C 'immedi':159C 'includ':50B,114C 'instanc':78B,104C,172C 'invit':54B,118C 'issu':180C 'lack':43B 'log':4A 'logged-in':3A 'low':176C 'low-privileg':175C 'modifi':135C 'non':52B,116C 'non-admin':51B,115C 'os':38B,87C 'overwrit':61B,133C 'patch':183C 'platform':136C 'prior':88C 'privileg':177C 'pull':141C 'read':8A,57B,128C 'regist':95C 'reinstal':143C 'restart':69B,145C 'rout':42B,99C 'self':27B,34B,83C 'self-host':26B,33B,82C 'servic':68B,73B,144C,166C 'set':12A,41B,98C,137C 'singl':102C 'success':152C 'switch':147C 'system':11A,40B,97C,131C 'tao':1A,29B,30B,79C,94C 'taos':19A 'tinyagento':93C 'tool':25B 'track':149C 'trigger':64B,138C 'updat':66B,150C 'user':6A,49B,55B,113C,119C,169C 'version':90C,185C 'whose':39B,120C 'write':156C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted taOS instance with more than one account, including invited non-admin users. The flaw lies in the settings routes, so any authenticated account can reach them; single-user instances where only the admin has an account are exposed only through that admin account.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["taos"],"ptokens":["taos"],"labels":["aiagents","aitooling","high","selfhosted","taos","vendor"],"campaign_type":null,"search_a":"'-2026':14A,17A '-67548':15A,18A 'chang':10A 'cve':13A,16A 'log':4A 'logged-in':3A 'read':8A 'set':12A 'system':11A 'tao':1A 'taos':19A 'user':6A","search_b":"'admin':45B,53B 'agent':22B,37B 'ai':21B,24B,36B 'ai-ag':20B 'ai-tool':23B 'authent':48B 'caus':70B 'check':46B 'configur':60B 'denial':71B 'everyon':75B 'full':59B 'host':28B,35B 'includ':50B 'instanc':78B 'invit':54B 'lack':43B 'non':52B 'non-admin':51B 'os':38B 'overwrit':61B 'read':57B 'restart':69B 'rout':42B 'self':27B,34B 'self-host':26B,33B 'servic':68B,73B 'set':41B 'system':40B 'tao':29B,30B 'tool':25B 'trigger':64B 'updat':66B 'user':49B,55B 'whose':39B","search_c":"'1.0.0':91C,186C 'account':178C 'admin':108C,117C,122C 'agent':86C 'ai':85C 'apirout':103C 'authent':112C 'author':109C 'beta.25':92C,187C 'branch':151C 'caus':158C 'configur':132C,160C 'corrupt':161C 'creat':105C 'denial':164C 'depend':110C,142C 'endpoint':157C 'explicit':125C 'exploit':153C 'fals':126C 'flag':123C 'full':130C 'git':140C 'host':84C 'immedi':159C 'includ':114C 'instanc':104C,172C 'invit':118C 'issu':180C 'low':176C 'low-privileg':175C 'modifi':135C 'non':116C 'non-admin':115C 'os':87C 'overwrit':133C 'patch':183C 'platform':136C 'prior':88C 'privileg':177C 'pull':141C 'read':128C 'regist':95C 'reinstal':143C 'restart':145C 'rout':99C 'self':83C 'self-host':82C 'servic':144C,166C 'set':98C,137C 'singl':102C 'success':152C 'switch':147C 'system':97C,131C 'tao':79C,94C 'tinyagento':93C 'track':149C 'trigger':138C 'updat':150C 'user':113C,119C,169C 'version':90C,185C 'whose':120C 'write':156C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T12:10:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67548","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67548","severity":null,"published_at":"2026-11-11T22:17:29+00:00","modified_at":"2026-11-11T22:17:29+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[{"id":129461,"url":"https://github.com/jaylfc/taOS/commit/6e65dd7ddd4b973e326d7ccb0ec74e8eef65374b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129462,"url":"https://github.com/jaylfc/taOS/releases/tag/v1.0.0-beta.25","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129463,"url":"https://github.com/jaylfc/taOS/security/advisories/GHSA-47g9-fwwp-hrfp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T12:10:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}