CVE-2026-53605 Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant
Local attackers can gain root privileges on Reachy Mini Wireless robots due to unrestricted sudo access for the pollen user.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-53605?
CVE-2026-53605 is a high-severity vulnerability in pollen-robotics reachy-mini-os, published on 30 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
Which versions are affected by CVE-2026-53605?
How do I fix CVE-2026-53605?
No fix has been published for CVE-2026-53605 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-53605 being exploited?
There is no known exploitation of CVE-2026-53605 in the wild and no public exploit code.
Sources
Also known as GHSA-7rhg-9v48-x3h2.