Description

The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential. The endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a Python package runs the package's own build and setup code, so whoever chooses the Space chooses what code the robot runs. Anyone can publish a public Hugging Face Space, so this is not a meaningful restriction on the attacker. How far this reaches depends on the model. In _resolve_bind_host in src/reachy_mini/daemon/app/main.py the daemon binds 0.0.0.0 when it runs as the wireless version and 127.0.0.1 otherwise, with the vendor's own comment explaining that the robot has to be reachable on the LAN. On a wireless unit, then, any host on the same network can install and run code on the robot without credentials. One related change has already shipped but does not fix this. Version 1.8.2 replaced the wildcard CORS policy with an allow list of localhost and Tauri origins. That closes the browser drive-by route, where a web page the victim visits silently calls the endpoint in the background. It has no effect on this issue: CORS is enforced by browsers and governs whether script may read a response, while a direct HTTP request from another machine on the network involves no browser, no preflight and no CORS check at all.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-23T11:17:18.690Z",
  "pubdate": "2026-09-23T11:17:18.690Z",
  "executiveSummary": "The Reachy Mini daemon contains a critical unauthenticated Remote Code Execution (RCE) vulnerability within its HTTP API. The application installation endpoint, POST /apps/install, lacks any form of authentication or authorization, allowing unauthorized remote actors to trigger the installation of arbitrary Python packages.\nBecause the installation process utilizes standard package management tools such as 'uv' or 'pip', the system automatically executes arbitrary code embedded within the setup or build scripts of the specified package. By pointing the endpoint to a malicious Hugging Face Space, an attacker can achieve full system compromise.\nThe vulnerability is exacerbated by the daemon's network configuration; on wireless units, the service binds to 0.0.0.0, exposing the management API to any host on the local network. Although version 1.8.2 introduced CORS restrictions, this does not mitigate the risk, as CORS is a browser-side security feature irrelevant to direct HTTP requests.\nThe impact includes complete loss of confidentiality, integrity, and availability of the robot. An attacker can gain persistent access, exfiltrate sensitive data, or manipulate the physical operations of the Reachy Mini.",
  "technicalDetails": "The root cause of this vulnerability is the absence of authentication middleware in the /apps/install endpoint defined in src/reachy_mini/daemon/app/routers/apps.py. The handler relies solely on a Dependency injection via get_app_manager, which serves only to retrieve the application state manager without validating the requestor's identity or authorization levels.\nThe attack flow begins with the attacker sending a specially crafted POST request to the /apps/install endpoint. The body of this request, structured as an AppInfo object, specifies a source—in this case, a URL pointing to an attacker-controlled Hugging Face Space. Upon receipt, the daemon invokes install_package in src/reachy_mini/apps/sources/local_common_venv.py. This function delegates the installation process to 'uv' or 'pip', both of which are designed to execute build-time scripts (e.g., setup.py) as part of the package installation lifecycle.\nBecause the daemon runs with sufficient privileges to modify the local environment and install packages, the arbitrary code within the malicious package executes with the same privileges as the daemon process. This effectively grants an attacker full Remote Code Execution capabilities on the underlying host operating system.\nThe network exposure is significant due to the behavior of _resolve_bind_host in src/reachy_mini/daemon/app/main.py. On wireless-capable units, the daemon binds to 0.0.0.0, making the API accessible to all devices on the local area network. Any device with network visibility to the robot can initiate the installation process without credentials.\nThe recent security update (version 1.8.2) implemented an allow-list for CORS to mitigate potential browser-based drive-by attacks. However, this is fundamentally ineffective against this vector. CORS (Cross-Origin Resource Sharing) is a mechanism implemented by web browsers to restrict cross-origin requests made via XHR or Fetch APIs; it does not protect against direct HTTP traffic originating from scripts, command-line tools like 'curl' or 'python-requests', or other automated network actors. Therefore, the authentication bypass remains fully exploitable via standard network requests."
}