CVE-2026-53605

Name of the Vulnerable Software and Affected Versions Reachy Mini ISO for Wireless versions prior to 0.2.4

Description The Reachy Mini Wireless OS image contains an overly broad sudoers entry that grants the pollen daemon user (uid 1000) passwordless sudo access to the /usr/bin/systemctl endpoint without subcommand or argument restrictions. This allows a local privilege escalation (LPE), where any process running as the pollen user can obtain full root (uid 0) privileges on the device using three commands without requiring user interaction.

Recommendations Update to version 0.2.4.