---
id: "CVE-2026-109444"
kind: "vulnerability"
aliases: ["CVE-2026-109444"]
title: "OpenSRE: approval gate bypass lets injected alerts run host shell commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "opensre", "fixed": [], "affected": "<= 0.1.2026.10.19", "ecosystem": "pip"}]
ecosystems: ["pip"]
tags: ["ai-tooling", "cloud-credentials", "opensre", "pip", "prompt-injection", "rce", "self-hosted", "slack"]
not_affected_if: ["interactive-approval-only", "managed-hosting"]
published_at: "2026-10-20T01:17:10+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:40:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109444", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:28:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:40:24+00:00"}]
---

# OpenSRE: approval gate bypass lets injected alerts run host shell commands

OpenSRE (Tracer-Cloud), an open-source AI SRE agent, runs shell_run and cli_exec with no approval on non-interactive surfaces (Slack/Telegram gateway, scheduled runs). The headless presenter's execution_allowed() always returns True. An attacker who can influence alert text (e.g. a Grafana or Loki runbook note) or a Slack message can make the agent run host commands and read the process environment: LLM keys, Slack tokens, DATABASE_URL, cloud credentials. Lasso also reports a fail-open messaging allowlist (no allowlist and pairing off gives open access). A Lasso PoC exists; no in-the-wild exploitation is reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:opensre affected <= 0.1.2026.10.19 fixed ?

## How to check

Run 'opensre --version' or 'pip show opensre': <= 0.1.2026.10.19 is affected. You are exposed if you run the gateway (Slack/Telegram), scheduled loops or any non-TTY surface that ingests alerts or chat messages. A plain interactive REPL session is not the headless path. Check for messaging allowed_user_ids and OPENSRE_PAIRING_SECRET, and look in ~/.opensre/memory/ for injected command preferences.

## Fix

No patched version is published as of 2026-10-23; v0.1.2026.10.23 changelog does not mention it, so unfixed unless you verify the code. Mitigate: set requires_approval=True on shell_run and cli_exec, make the headless presenter fail closed, give the process a scoped environment with minimal credentials, set a messaging allowlist and pairing secret, stop forwarding untrusted alert text, and rotate credentials if exposure is suspected.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109444
- 2026-10-23T22:28:39+00:00 analyst — Read Lasso (finder, PoC) and VulnCheck advisories plus OpenSRE releases page. No fixed version is published; releases through v0.1.2026.10.23 do not mention a fix. No in-the-wild exploitation reported; Lasso has a PoC (local model, deterministic). Did not search social posts.
- 2026-10-23T22:40:24+00:00 analyst — Re-triage had blanked how-to-check and fix; restored. No new sources or documents since run 229. Still no fixed release (latest seen v0.1.2026.10.23). Headless is not the default: the interactive REPL needs a TTY; the flaw applies to gateway (Slack/Telegram), scheduled and embedded non-TTY surfaces per Lasso, and possibly opensre ask (unconfirmed).

## Documents

- [advisory] Lasso: CVE-2026-109444 OpenSRE Prompt Injection to RCE (finder, PoC) https://www.lasso.security/vulnerability-database/cve-2026-109444
- [advisory] VulnCheck advisory CVE-2026-109444 https://www.vulncheck.com/advisories/opensre-through-0.1.2026.10.19-approval-gate-bypass-via-shell-run-prompt-injection
- [mentions] OpenSRE releases (latest v0.1.2026.10.23, no fix noted) https://github.com/Tracer-Cloud/opensre/releases

## From the sources

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_