CVE-2026-53605

Reachy Mini Wireless OS images built before version 0.2.4 ship an overly broad sudoers rule that lets the pollen daemon user (uid 1000) run /usr/bin/systemctl as root with no password and no restriction on subcommands or arguments. A local process already running as pollen can abuse that unrestricted systemctl access to gain full root (uid 0) without another bug or any user interaction. Impact is complete loss of confidentiality, integrity, and availability on the robot. Only Reachy Mini Wireless devices using OS images earlier than 0.2.4 are affected; version 0.2.4 fixes the sudoers entry. There is no known public proof-of-concept and no evidence of exploitation in the wild, and the issue is not listed in CISA KEV.

What to do: Upgrade Reachy Mini Wireless OS images to version 0.2.4 or later and redeploy devices built from older images. Confirm /etc/sudoers (and sudoers.d) no longer grants the pollen user passwordless, unrestricted access to /usr/bin/systemctl, and restrict systemctl to the specific subcommands the daemon needs. Treat any untrusted local process running as pollen as a full-root risk until the image is updated.