bREACHYing the Perimeter: How One HTTP Request can Hijack your AI Robot

What it is

JFrog Security Research found five CVEs in the Reachy Mini daemon (reachy-mini-daemon), the Python service on Pollen Robotics and Hugging Face's open-source robot. Only one CVE is named on the page: CVE-2026-55419, the unauthenticated file upload in the Bluetooth chain. The fix is version 1.11.0. The page does not say which version introduced the flaws.

How it works

Three design choices combine. There is no authentication on any endpoint. CORS is allow_origins=["*"] (main.py:256-261). The --localhost-only flag is never passed to the uvicorn bind (main.py:366-371), so the daemon listens on *:8000 in every mode. The flag only controls whether the WLAN IP is computed for display. The robot also advertises itself over mDNS as _reachy-mini._tcp.local..

HTTP path to root. POST /api/apps/install accepts source_kind: "local" with extra.path set to any URL. That value goes straight into uv pip install, so the attacker's sdist runs its setup.py as user pollen. The pollen user has passwordless sudo. The page's PoC writes a systemd unit with sudo tee, runs daemon-reload and enable --now, and adds an SSH key to root's authorized_keys. The authors report this persisted across reboots. source_kind: "hf_space" gives the same result through snapshot_download.

Browser variant. Any web page's JavaScript can call /api/hf-auth/status to see whether the operator is logged in to Hugging Face. It can then POST to /api/apps/install-private-space, which installs an attacker-controlled Space using the stored token. CORS lets the script read the job_id, and /api/apps/job-status/<uuid> confirms execution.

Bluetooth path to root. This chain needs Bluetooth proximity plus LAN or CORS access for the upload, and has three steps:

1. Upload a script to /api/media/sounds/upload, which has no auth and no extension check (CVE-2026-55419).
2. Pair over BLE ("Just Works"). The PIN check sets one global self.connected flag, so a second device inherits another device's authentication. There is no brute-force limit on the 5-character PIN.
3. Send CMD_/path/to/uploaded/pwn. os.path.join discards commands/ when given an absolute path, and the script runs under sudo.

flowchart LR
    A[Attacker on LAN] --> B[POST /api/apps/install]
    W[Malicious web page] --> C[install-private-space with operator HF token]
    B --> D[Code as pollen]
    C --> D
    D --> E[sudo: root via systemd unit]
    A --> F[Upload pwn.sh]
    F --> G[BLE PIN bypass + CMD_ path traversal]
    G --> E

Preconditions / Affected

Any Reachy Mini daemon reachable on TCP 8000, whether on the robot or a workstation, is affected. Home Wi-Fi, a conference booth or a corporate LAN all count. The browser variant needs the operator to visit a malicious page while the robot is reachable. The HF token theft needs a stored token at ~/.cache/huggingface/token. The page does not give a version range for affected releases.

What to do

Update to 1.11.0. To check exposure:

# On the machine running the daemon (robot or workstation)
lsof -nP -iTCP:8000 -sTCP:LISTEN
# If output shows "TCP *:8000 (LISTEN)" → exposed to the full LAN

# Or from any device on the same network:
curl -s http://reachy-mini.local:8000/api/daemon/hardware-id
# If you get a JSON response → the daemon is reachable and unauthenticated

Interim mitigations, which the page says are not equivalent to patching:

• Firewall the port on the robot: sudo ufw deny in on wlan0 to any port 8000. On a workstation, block 8000 on all interfaces except loopback.
• Do not install untrusted apps.
• Replace the blanket pollen ALL=(ALL) NOPASSWD: ALL sudoers entry with the minimum commands the daemon needs.
• Do not browse the web on a device sharing the robot's network.

For fleets (classrooms, labs, demos), update every unit, segment the network or use dedicated VLANs, and monitor for _reachy-mini._tcp.local. announcements.

Caveats

The page describes worm-style spread over mDNS and a Hugging Face Space takeover as feasible, not demonstrated. The advice on the Hugging Face case is limited to the workarounds above. The authors' fix suggestion is authentication on every state-changing endpoint, CORS restricted to the dashboard origin, and rejecting the LOCAL source kind at the router. Unauthenticated /api/wifi/forget_all and /api/wifi/setup_hotspot let an attacker move the robot onto an attacker-controlled access point.