Live › vulnerability › CVE-2026-109444
Go to dashboardOpenSRE (Tracer-Cloud), an open-source AI SRE agent, runs shell_run and cli_exec with no approval on non-interactive surfaces (Slack/Telegram gateway, scheduled runs). The headless presenter's execution_allowed() always returns True. An attacker who can influence alert text (e.g. a Grafana or Loki runbook note) or a Slack message can make the agent run host commands and read the process environment: LLM keys, Slack tokens, DATABASE_URL, cloud credentials. Lasso also reports a fail-open messaging allowlist (no allowlist and pairing off gives open access). A Lasso PoC exists; no in-the-wild exploitation is reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| opensre | pip | <= 0.1.2026.10.19 | – |
opensre --version or pip show opensre: <= 0.1.2026.10.19 is affectedv0.1.2026.10.23 changelog does not mention it, so unfixed unless you verify the codeEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-109444")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.