Skip to content
OpenAdvisories

Product · pollen-robotics

Reachy Mini

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-96455

    Reachy Mini daemon allows unauthenticated remote code execution through the app installation endpoint

    The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just ha…

    pollen-robotics Reachy Mini