High severity · published Sep 30, 2026
CVE-2026-53605
Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Reachy Mini ISO for Wireless contains the necessary files to build a custom Raspberry Pi OS image for the Reachy Mini Wireless robot, using pi-gen. Prior to version 0.2.4, the Reachy Mini Wireless OS image shipped with an overly broad sudoers entry granting the pollen daemon user (uid 1000) passwordless sudo access to /usr/bin/systemctl with no subcommand or argument restriction. This is a local privilege escalation (LPE). Any process running as pollen can obtain full root (uid 0) on the device in three commands, with no additional vulnerability required and no user interaction. This issue has been patched in version 0.2.4.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 2% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
reachy-mini-os · pollen-robotics
< 0.2.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-53605
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-53605
x_refsource_CONFIRM
https://github.com/pollen-robotics/reachy-mini-os/security/advisories/GHSA-7rhg-9v48-x3h2
x_refsource_MISC
https://github.com/pollen-robotics/reachy-mini-os/commit/cee4076f36bd95a2a6b894a56a48c7e971e75445
x_refsource_MISC
https://github.com/pollen-robotics/reachy-mini-os/releases/tag/v0.2.4
