CVE-2026-96455 Overview
CVE-2026-96455 is a missing authentication vulnerability [CWE-306] in the Reachy Mini daemon from Pollen Robotics. The daemon exposes an HTTP API endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, that accepts a Hugging Face Space name and installs it as a Python package. The handler enforces no credential check. On the wireless variant of the robot, the daemon binds to 0.0.0.0, allowing any host on the same local network to trigger installation of arbitrary attacker-controlled code.
Critical Impact
An unauthenticated adjacent-network attacker can install a malicious Hugging Face Space as a Python package on the robot, achieving arbitrary code execution through package build and setup hooks.
Affected Products
- Pollen Robotics Reachy Mini daemon (wireless variant, binds 0.0.0.0)
- Reachy Mini versions prior to v1.11.0
- Version 1.8.2 CORS hardening does not remediate this issue
Discovery Timeline
- 2026-09-23 - CVE-2026-96455 published to the National Vulnerability Database (NVD)
- 2026-09-23 - Last updated in NVD database
- Fix released - Reachy Mini Release v1.11.0 and Pull Request #1207
Technical Details for CVE-2026-96455
Vulnerability Analysis
The Reachy Mini daemon exposes a FastAPI router that manages robot applications. The POST /apps/install handler accepts an AppInfo request body naming a Hugging Face Space. Its only dependency is Depends(get_app_manager), which returns the manager object held in application state. No credential, token, or session check exists in the request chain.
When invoked, the handler calls install_package in src/reachy_mini/apps/sources/local_common_venv.py. This function downloads the referenced Space and installs it as a Python package using uv or pip. Package installation executes the target's own build and setup code, so the caller effectively selects the code the robot runs. Any user can publish a public Hugging Face Space, which removes any practical restriction on the attacker.
Root Cause
The root cause is missing authentication [CWE-306] on a privileged administrative endpoint. The FastAPI dependency graph for POST /apps/install never introduces an authentication or authorization step. The design assumption that a network-bound interface is a trusted management surface is invalid on the wireless robot.
Attack Vector
In _resolve_bind_host within src/reachy_mini/daemon/app/main.py, the daemon binds 0.0.0.0 when running as the wireless variant and 127.0.0.1 otherwise. The vendor comment states the robot must be reachable on the local area network (LAN). On a wireless unit, any host on the same network can send a direct HTTP request to install and execute code without credentials.
The CORS allow-list added in version 1.8.2 restricts browser-mediated cross-origin requests to localhost and Tauri origins. CORS is enforced by browsers and controls whether script may read a response. A direct HTTP request from another host on the LAN involves no browser, no preflight, and no CORS check, so this mitigation does not apply.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-96455
Indicators of Compromise
- Unexpected POST /apps/install requests to the Reachy Mini daemon originating from LAN hosts other than the operator workstation.
- New Python packages installed under the daemon virtual environment that reference unfamiliar Hugging Face Spaces.
- Outbound network connections from the robot to huggingface.co initiated shortly after inbound HTTP traffic on the daemon port.
Detection Strategies
- Monitor the daemon's HTTP access logs for POST /apps/install calls and correlate the source IP against an approved administrator list.
- Alert on invocations of uv pip install or pip install by the daemon process outside a documented change window.
- Inspect the application state directory for newly created app entries whose source is a Hugging Face Space not on an internal allow list.
Monitoring Recommendations
- Capture network flow data on the wireless segment hosting the robot and flag any host initiating TCP connections to the daemon port.
- Log process execution on the robot to detect child processes spawned from newly installed package build scripts.
- Track daemon version strings across the fleet to identify units running builds prior to v1.11.0.
How to Mitigate CVE-2026-96455
Immediate Actions Required
- Upgrade the Reachy Mini daemon to v1.11.0 or later, which addresses the missing authentication in Pull Request #1207.
- Move affected robots onto an isolated management VLAN restricted to trusted operator hosts.
- Audit installed apps for any packages that were not installed by an authorized operator and remove them.
Patch Information
The fix ships in Reachy Mini v1.11.0. Review the merged changes in the router source and the main application entry point to confirm the authentication dependency is present on POST /apps/install.
Workarounds
- Bind the daemon to 127.0.0.1 and reach the robot only through an authenticated tunnel such as SSH port forwarding or a VPN.
- Place a host-based firewall rule on the robot that drops inbound traffic to the daemon port from all addresses except a fixed operator IP.
- Segment wireless robots on a dedicated SSID with client isolation enabled to block peer-to-peer LAN access.
# Example iptables rule restricting daemon access to a single operator host
sudo iptables -A INPUT -p tcp --dport 8080 -s 192.0.2.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8080 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
