CVE-2026-67547

An ordinary taOS account could run privileged built-in skills

taOS maintainers · taOS skill runtime

First documented disclosure · Review checkpoint

Summary

The skill runtime did not verify the caller’s role, assignment or ownership. Built-in execution capabilities could run code with the backend service account's permissions.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed advisory does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The skill runtime did not verify the caller’s role, assignment or ownership.

Conditions required

A signed-in non-administrator had access to the skill runtime.

Potential impact

Built-in execution capabilities could run code with the backend service account's permissions.

Affected versions and configurations

Before 1.0.0-beta.23.

Fix and mitigation status

1.0.0-beta.23.

Practical next steps

Upgrade taOS and restrict sensitive built-in skills to their authorized operators.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The public disclosure was on 2026-07-04. The CVE record was published on 2026-11-11.

Sources