Reachy Mini: one HTTP request runs code on Hugging Face's robot

01What happened

JFrog researchers Yuval Moravchick and Natan Nehorai published their Reachy Mini research on November 3, 2026, covering five CVEs they reported to Pollen Robotics in May and June 2026. The CVE records went public between June and September; the write-up that chains them into working attacks is new.

02How it works

The reachy-mini-daemon is a FastAPI service that binds to 0.0.0.0 on port 8000 in every mode, including the USB-tethered Lite unit and simulation. Its POST /apps/install endpoint takes a local path or a Hugging Face Space name and hands it to uv pip install, which runs the package's own setup code. Broad passwordless sudo rights for the pollen user turn that execution into root. A separate Bluetooth chain defeats a global authentication flag and uses absolute-path traversal to run an uploaded file as root.

03Who is affected

Owners of Reachy Mini Lite and Wireless units are exposed to any host on the same network, because the daemon binds to every interface and the --localhost-only flag does not change the bind address. Developers who keep a Hugging Face token on the robot are exposed further: JFrog says an attacker can use it to take over a published Space, which other robots are then offered as an update.

04What to do

Block port 8000 on the robot's network interface, for example with sudo ufw deny in on wlan0 to any port 8000, and do not install untrusted apps. JFrog says to update the daemon to v1.11.0 and to replace the blanket NOPASSWD sudo rule for the pollen user with only the commands the daemon needs.

Questions people ask

Is a Reachy Mini Lite affected, or only the wireless model?

Reachy Mini Lite units are affected too. JFrog reports that the reachy-mini-daemon binds to 0.0.0.0 port 8000 in wireless, Lite and simulation modes alike, so even the USB-tethered unit is reachable from any host on the same network. The --localhost-only flag does not change the bind address, so passing it is not a mitigation.

Which Reachy Mini release fixes the unauthenticated install endpoint?

JFrog recommends updating to Reachy Mini v1.11.0 but does not state which release fixes each remaining CVE, and the pull request that closed the wildcard CORS hole describes the daemon API as still unauthenticated. Treat the firewall rule on port 8000 as the control that matters today, and read the v1.11.0 release notes before relying on a version number alone.

Can a web page I visit attack a Reachy Mini on my network?

A visited web page could, until the CORS change. JFrog describes a chain in which the daemon's wildcard CORS policy let any site send install requests to the robot using the operator's stored Hugging Face token. Pull request 1207 restricted CORS to localhost origins in June 2026, which closes the browser route but leaves direct network requests unaffected.

What happens to my Hugging Face token if the robot is compromised?

A compromised Reachy Mini puts the operator's Hugging Face token at risk, because the daemon keeps it at ~/.cache/huggingface/token for Space installs. JFrog says an attacker who reads that token can take over a published Space and turn it into a malicious app, which other robots are then offered as an update. Rotate the token after any suspected compromise.

Sources 3 links, all fetched

1. 1jfrog.comJFrog Research
2. 2github.comReachy Mini v1.11.0
3. 3github.comCORS Fix Pull Request