CVE-2026-55419: Reachy Mini SDK Auth Bypass Vulnerability

CVE-2026-55419 Overview

CVE-2026-55419 affects the Reachy Mini SDK, which controls Reachy Mini robots developed by Pollen Robotics. The Reachy Mini daemon exposes the /api/media/sounds/upload endpoint without authentication, file-extension checks, content validation, or size limits. The daemon binds to 0.0.0.0 by default and applies permissive CORS with allow_origins=["*"]. An unauthenticated network attacker can upload arbitrary files to /tmp/reachy_mini_sounds/<original_filename>. The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type [CWE-434] and is fixed in version 1.8.2.

Critical Impact
Any network-reachable attacker can write arbitrary files to the daemon host, threatening stored-data integrity and enabling chained exploitation.

Affected Products

Reachy Mini SDK versions prior to 1.8.2
Reachy Mini daemon component (src/reachy_mini/daemon/app/routers/media.py)
Deployments exposing the daemon on 0.0.0.0 with default CORS settings

Discovery Timeline

2026-08-25 - CVE-2026-55419 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-55419

Vulnerability Analysis

The Reachy Mini daemon implements the upload_sound handler in src/reachy_mini/daemon/app/routers/media.py. The handler accepts multipart uploads and writes files directly to /tmp/reachy_mini_sounds/ using the client-supplied filename. Existing files with the same name are overwritten. The endpoint performs no authentication, no extension allowlisting, no MIME or magic-byte inspection, and no size cap. Attackers can therefore stage arbitrary payloads on disk, including scripts, configuration files, or binaries.

Root Cause

Three design decisions combine to produce the flaw. First, the daemon binds to 0.0.0.0, making the endpoint reachable on all interfaces by default. Second, the FastAPI CORS middleware is configured with allow_origins=["*"], permitting cross-origin browser-driven uploads. Third, the upload_sound function trusts caller input entirely, skipping the validation steps documented as [CWE-434] Unrestricted File Upload.

Attack Vector

Exploitation requires only network reachability to the daemon port. An attacker issues a POST request to /api/media/sounds/upload with a multipart form payload. The daemon writes the payload verbatim to /tmp/reachy_mini_sounds/<original_filename>. Because the endpoint returns the absolute path of the saved file, the attacker gains confirmation of the write location. The uploaded file becomes a foothold when combined with any secondary flaw that reads, executes, or plays the staged content.

python

# Security patch from examples/sound_play.py (v1.8.2)
# Source: https://github.com/pollen-robotics/reachy_mini/commit/984c7723b3ec5da63f4e0a2bcf9f120ceb563e04

def play_file(mini: "ReachyMini", file_path: str) -> None:
    """Play a sound file using the media play_sound API."""
    file_path = os.path.abspath(file_path)

The accompanying OpenAPI specification was updated to document the new controls: "The upload is restricted to known audio extensions, capped at MAX_SOUND_UPLOAD_BYTES, and validated by content before being stored, so non-audio payloads cannot be written to disk." See the GitHub Commit Update for the full patch.

Detection Methods for CVE-2026-55419

Indicators of Compromise

Unexpected files present in /tmp/reachy_mini_sounds/ with non-audio extensions or content
HTTP POST requests to /api/media/sounds/upload from unfamiliar source addresses
Preflight OPTIONS requests from arbitrary web origins accepted by the daemon
File writes to the daemon host originating from the Reachy Mini process outside expected operator workflows

Detection Strategies

Inspect daemon access logs for POST traffic to /api/media/sounds/upload and correlate with authorized operator activity
Compare file magic bytes in /tmp/reachy_mini_sounds/ against declared audio formats (WAV, OGG, MP3, FLAC)
Monitor for the daemon socket bound to 0.0.0.0 on network-exposed segments using standard host telemetry
Alert on any process reading or executing files from /tmp/reachy_mini_sounds/ outside the daemon's playback path

Monitoring Recommendations

Enable file integrity monitoring on /tmp/reachy_mini_sounds/ to capture create, modify, and overwrite events
Capture network flow data for the daemon listening port and baseline expected client sources
Forward daemon HTTP logs to a centralized log platform for retention and correlation with host events

How to Mitigate CVE-2026-55419

Immediate Actions Required

Upgrade Reachy Mini to version 1.8.2 or later, which enforces extension allowlisting, size limits, and content validation
Restrict network exposure of the daemon by binding to 127.0.0.1 or placing the host on an isolated management network
Audit /tmp/reachy_mini_sounds/ for unexpected files and remove any content that fails audio validation
Rotate any credentials or keys that may have been staged through the endpoint prior to patching

Patch Information

The fix ships in GitHub Release v1.8.2, merged via GitHub Pull Request #1209. Full technical context is available in GitHub Security Advisory GHSA-m2pc-3q4q-w6jr.

Workarounds

Front the daemon with a reverse proxy that enforces authentication and rejects requests to /api/media/sounds/upload
Apply host firewall rules limiting daemon access to trusted operator addresses
Tighten CORS by removing allow_origins=["*"] and specifying explicit origins for browser clients
Mount /tmp/reachy_mini_sounds/ with noexec to reduce the impact of staged executable payloads

bash

# Restrict daemon exposure at the host firewall (example using nftables)
nft add rule inet filter input tcp dport <daemon_port> ip saddr != 10.0.0.0/24 drop

# Verify installed Reachy Mini version
pip show reachy_mini | grep -i version

# Upgrade to the patched release
pip install --upgrade "reachy_mini>=1.8.2"