A desktop robot should not have an unauthenticated “install” button that runs as root. The Injection reports that JFrog published CVE-2026-96455 (CVSS 8.8) on November 3, 2026, covering Reachy Mini, the open-source robot from Pollen Robotics and Hugging Face. JFrog’s write-up, as summarized there, says the robot “exposes an unauthenticated install endpoint that runs attacker code as root.” JFrog recommends blocking port 8000. The Injection’s week-45 listing does not name a fixed version.
Quick Take
- Product: Reachy Mini, an open-source robot associated with Pollen Robotics and Hugging Face.
- Bug: An unauthenticated HTTP install endpoint executes attacker-supplied code as root (CVE-2026-96455, CVSS 8.8).
- Immediate mitigation: Block port 8000 so the endpoint is not reachable on the network.
- Patch status: As of The Injection’s November 2–8 roundup, no fixed version was listed. Treat the issue as unpatched until the vendor publishes one.
What happened
Physical AI devices increasingly ship with a local web or agent API so a model can install skills, move the arm, or update software. If that API has an install endpoint with no authentication, anyone who can reach the port can run code with the privileges of the service — here, root. JFrog published the full chain on November 3.
i10x has not independently confirmed whether a later firmware or software release has since closed the endpoint. Until a vendor advisory names a fixed version, the safe assumption is that network exposure of port 8000 remains dangerous.
What you should do
- If you have a Reachy Mini on a lab or office network, block inbound access to port 8000 at the host and on the local network, and do not expose the robot to the internet.
- Watch Pollen Robotics and Hugging Face for a patched release; apply it when it exists, then confirm the install endpoint requires authentication and no longer runs as root.
- If the device has been reachable on a shared network, treat it as potentially compromised and rebuild or re-image it.
What it means
This is what happens when an “agent runtime” is bolted onto a machine that can also move and that runs as root. The vulnerability class is old — unauthenticated RCE on a debug or install port — but the target is new enough that many labs will have put the robot on the same Wi-Fi as laptops and other devices. Until there is a patch, network isolation is the control.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on The Injection’s week-45 summary of JFrog’s November 3, 2026 advisory for CVE-2026-96455. i10x did not test a Reachy Mini and did not review a later vendor patch announcement after that roundup.
