Threat
NVD-CVE-2026-67547
Publication date unknown · Discovered nist.gov
Page published
Publication date unknown · First observed: 14 Nov 2026
Coverage timeline
Single-source advisory — one report is available.
Why it matters
The taOS authorization flaw exposes host-level code execution to ordinary authenticated users, making an upgrade to version 1.0.0-beta.23 important for affected deployments.
CVE-2026-67547 allows authenticated non-admin users of taOS, a self-hosted AI agent OS, to execute arbitrary Python as the backend process user through POST /api/skill-exec/{skill_id}/call. The endpoint lacks admin-role, skill-ownership, and agent-assignment checks; version 1.0.0-beta.23 fixes the vulnerability.