Two high-severity flaws disclosed in taOS enable remote code execution

GitHub Security Advisories disclosed two high-severity vulnerabilities in taOS, a self-hosted AI agent operating system built by jaylfc/tinyagentos, on November 11, 2026: a missing-authorization flaw in skill execution that lets any authenticated user achieve remote code execution, and a separate missing-authorization flaw on system-settings routes that enables a full config takeover.

The two vulnerabilities

• CVE-2026-67547 (GHSA-h24f-gp4c-8qjm) scored CVSS 8.8, high severity, published November 11, 2026, and fixed in taOS v1.0.0-beta.23.
• The flaw sits in the POST /api/skill-exec/{skill_id}/call endpoint, which runs built-in skills including code_exec, executing arbitrary Python via subprocess.run with no admin-role, ownership, or agent-assignment check.
• Any authenticated non-admin user could submit attacker-controlled Python in the request body and gain full remote code execution as the taOS backend process user.
• CVE-2026-67548 (GHSA-47g9-fwwp-hrfp) scored CVSS 8.3, high severity, published November 11, 2026, and fixed in taOS v1.0.0-beta.25.
• All system-settings routes were registered under a single APIRouter with no admin-authorization dependency.
• Any authenticated user, including non-admin invited users with is_admin=False, could read full system config, overwrite settings, trigger a git pull plus dependency reinstall plus service restart, and switch the tracked update branch.

What it means for people building with AI

Both bugs share the same root cause: missing authorization checks on agent and skill-execution endpoints as well as settings endpoints. It is another instance of the authenticated-low-privilege-to-RCE pattern recurring across self-hosted AI agent frameworks, directly relevant to anyone running taOS or similar agent OS software in production, since a single invited, low-privilege account was enough to run arbitrary code or rewrite the entire system configuration.

Fixes and availability

Teams running taOS should upgrade past v1.0.0-beta.23 to close the skill-execution flaw and past v1.0.0-beta.25 to close the settings authorization bypass, since both advisories confirm the issues are resolved in those releases.

Sources

• CVE-2026-67547 taOS skill-exec RCE (GitHub Security Advisories, November 11, 2026, official)
• CVE-2026-67548 taOS settings authorization bypass (GitHub Security Advisories, November 11, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.