{"id":"CVE-2026-109444","kind":"vulnerability","aliases":["CVE-2026-109444"],"related":[],"title":"OpenSRE: approval gate bypass lets injected alerts run host shell commands","description":"OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.","summary":"OpenSRE (Tracer-Cloud), an open-source AI SRE agent, runs shell_run and cli_exec with no approval on non-interactive surfaces (Slack/Telegram gateway, scheduled runs). The headless presenter's execution_allowed() always returns True. An attacker who can influence alert text (e.g. a Grafana or Loki runbook note) or a Slack message can make the agent run host commands and read the process environment: LLM keys, Slack tokens, DATABASE_URL, cloud credentials. Lasso also reports a fail-open messaging allowlist (no allowlist and pairing off gives open access). A Lasso PoC exists; no in-the-wild exploitation is reported.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"opensre","fixed":[],"affected":"<= 0.1.2026.10.19","ecosystem":"pip"}],"ecosystems":["pip"],"tags":["ai-tooling","cloud-credentials","opensre","pip","prompt-injection","rce","self-hosted","slack"],"not_affected_if":["interactive-approval-only","managed-hosting"],"how_to_check":"Run 'opensre --version' or 'pip show opensre': <= 0.1.2026.10.19 is affected. You are exposed if you run the gateway (Slack/Telegram), scheduled loops or any non-TTY surface that ingests alerts or chat messages. A plain interactive REPL session is not the headless path. Check for messaging allowed_user_ids and OPENSRE_PAIRING_SECRET, and look in ~/.opensre/memory/ for injected command preferences.","fix":"No patched version is published as of 2026-10-23; v0.1.2026.10.23 changelog does not mention it, so unfixed unless you verify the code. Mitigate: set requires_approval=True on shell_run and cli_exec, make the headless presenter fail closed, give the process a scoped environment with minimal credentials, set a messaging allowlist and pairing secret, stop forwarding untrusted alert text, and rotate credentials if exposure is suspected.","status":"open","published_at":"2026-10-20T01:17:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:45+00:00","updated_at":"2026-10-23T22:40:24+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:39:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"OpenSRE: approval gate bypass lets injected alerts run host shell commands","impact":"high","summary":"OpenSRE's headless mode always approves shell_run commands without asking, so an attacker who injects instructions into an alert or Slack message can run commands on the host. The attacker can then read and exfiltrate LLM, Slack and cloud credentials stored there.","category":"ai-tooling","who_cares":["opensre","pip","self-hosted","slack","cloud-credentials"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs shell commands on the host and steals cloud and Slack credentials.","analyst_note":"Confirm the fixed version (products list shows fixed ?) and whether headless or alert-triage mode is the default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109444.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting","interactive-approval-only"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000502,"input_tokens":3013,"output_tokens":402,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version (products list shows fixed ?) and whether headless or alert-triage mode is the default; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-109444.","search":"'-109444':14A,17A '-2026':13A,16A '0.1.2026.10.19':142C 'access':127B 'agent':45B,94B,181C 'ai':20B,43B 'ai-tool':19B 'alert':7A,78B,174C 'allow':69B,150C,165C 'allowlist':119B,121B 'also':112B 'alway':70B,166C 'approv':2A,54B,145C 'attack':74B,151C,169C 'bypass':4A,147C 'cli':50B 'cloud':23B,38B,109B,193C 'cloud-credenti':22B 'command':11A,97B,156C,184C 'confirm':158C 'contain':143C 'credenti':24B,110B,194C 'cve':12A,15A 'databas':107B 'e.g':80B 'environ':102B 'exec':51B 'execut':68B,153C,164C 'exfiltr':189C 'exist':131B 'exploit':137B 'fail':116B 'fail-open':115B 'gate':3A,146C 'gateway':61B 'give':125B 'grafana':82B 'headless':65B,161C 'host':9A,33B,96B,187C 'in-the-wild':133B 'influenc':77B 'inject':6A,29B,171C 'instruct':172C 'interact':58B 'key':104B 'lasso':111B,129B 'let':5A 'llm':103B,190C 'loki':84B 'make':92B 'messag':90B,118B,177C 'non':57B 'non-interact':56B 'note':86B 'open':41B,117B,126B 'open-sourc':40B 'opensr':1A,25B,35B,140C 'opensre':18A 'pair':123B 'pip':26B 'poc':130B 'present':66B,162C 'process':101B 'prompt':28B 'prompt-inject':27B 'rce':30B 'read':99B 'report':113B,139B 'return':71B,167C 'run':8A,46B,48B,63B,95B,155C,183C 'runbook':85B 'schedul':62B 'self':32B 'self-host':31B 'shell':10A,47B,154C 'slack':34B,89B,105B,176C,191C 'slack/telegram':60B 'sourc':42B 'sre':44B 'surfac':59B 'text':79B 'token':106B 'tool':21B 'tracer':37B 'tracer-cloud':36B 'triag':178C 'true':72B,168C 'url':108B 'vulner':148C 'wild':136B 'without':157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109444","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109444","severity":null,"published_at":"2026-10-20T01:17:10+00:00","modified_at":"2026-10-22T22:18:00+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109444:229","url":null,"severity":null,"published_at":"2026-10-23T22:28:39+00:00","modified_at":"2026-10-23T22:28:39+00:00","first_seen_at":"2026-10-23T22:28:39+00:00","fetched_at":"2026-10-23T22:28:39+00:00","note":"Read Lasso (finder, PoC) and VulnCheck advisories plus OpenSRE releases page. No fixed version is published; releases through v0.1.2026.10.23 do not mention a fix. No in-the-wild exploitation reported; Lasso has a PoC (local model, deterministic). Did not search social posts."},{"source":"analyst","external_id":"CVE-2026-109444:276","url":null,"severity":null,"published_at":"2026-10-23T22:40:24+00:00","modified_at":"2026-10-23T22:40:24+00:00","first_seen_at":"2026-10-23T22:40:24+00:00","fetched_at":"2026-10-23T22:40:24+00:00","note":"Re-triage had blanked how-to-check and fix; restored. No new sources or documents since run 229. Still no fixed release (latest seen v0.1.2026.10.23). Headless is not the default: the interactive REPL needs a TTY; the flaw applies to gateway (Slack/Telegram), scheduled and embedded non-TTY surfaces per Lasso, and possibly opensre ask (unconfirmed)."}],"documents":[{"id":1468,"url":"https://www.lasso.security/vulnerability-database/cve-2026-109444","title":"Lasso: CVE-2026-109444 OpenSRE Prompt Injection to RCE (finder, PoC)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1469,"url":"https://www.vulncheck.com/advisories/opensre-through-0.1.2026.10.19-approval-gate-bypass-via-shell-run-prompt-injection","title":"VulnCheck advisory CVE-2026-109444","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1470,"url":"https://github.com/Tracer-Cloud/opensre/releases","title":"OpenSRE releases (latest v0.1.2026.10.23, no fix noted)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}