OPSTREE REMS · CVE-2026-126767 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
OpsTree REMS through 1.0.0 has an AI chat endpoint (POST /api/v1/rca/chat) that can be tricked by crafted input into revealing its hidden system prompt. An authenticated user can read the internal orchestration instructions, which makes further prompt injection attacks easier to craft.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running OpsTree REMS 1.0.0 or earlier with the RCA chat feature enabled. The exposure is through the chat endpoint that accepts user input, so any user with an account on that endpoint can trigger it. Deployments without the chat endpoint in use are unlikely to be affected.
Not affected if auth-required
Who cares ai-chat, opstree-rems, self-hosted
1.0.0OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.