CVE-2026-67547

Published 11 November 2026 · tracked since 12 November 2026

Description

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.23, the POST /api/skill-exec/{skill_id}/call endpoint in taOS executes built-in skills — including the code_exec skill which runs arbitrary Python via subprocess.run(["python3", "-c", code]) — without performing any admin role check, ski

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-126912 CRITICAL 9.6
• CVE-2026-126909 CRITICAL 9.6
• CVE-2026-126885 CRITICAL 9.6
• CVE-2026-126879 HIGH 8.8
• CVE-2026-126876 HIGH 8.8
• CVE-2026-126874 HIGH 8.8
• CVE-2026-126873 HIGH 8.8
• CVE-2026-126872 CRITICAL 9.6
• CVE-2026-126869 HIGH 8.8
• CVE-2026-126868 HIGH 8.8

→ Open the live CVE board · all tools