OpenSRE: instructions planted in alerts or Slack messages make the AI SRE agent run shell commands on its host, because the approval check in headless mode always allows execution; CVE published 20 October 2026
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | not evidenced in source | assertion | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | low |
| Mandate: objective | Triage alerts and Slack messages (the record states the agent triages them) | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | medium |
| Actor | OpenSRE through 0.1.2026.10.19, an open-source AI agent maintained by Tracer-Cloud (the vendor named in the CVE record) that triages alerts and Slack messages and has a shell_run tool | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | high |
| Inputs | Instructions injected into alerts or Slack messages that the agent triages | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | high |
| Decision | The agent can act on the injected instructions and call shell_run; in headless mode the presenter's execution_allowed() always returns True, so the approval gate is bypassed | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | high |
| Envelope: constraints | An approval gate on shell_run, which the headless presenter does not enforce (CWE-862, missing authorization). The accounts differ on whether shell_run opts into the gate: Lasso Security's write-up says shell_run never sets the approval flag (requires_approval), while the project's code at the affected commit 8eba8c9 (version 0.1.2026.10.19) marks shell_run requires_approval=True, a setting added on 6 October 2026 (commit ae5d449). Both accounts agree that on headless surfaces the presenter allows the command without asking | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7; Lasso Security vulnerability database, 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection'; Tracer-Cloud/opensre on GitHub: tools/interactive_shell/actions/shell.py at commit 8eba8c9 (tag v0.1.2026.10.19), shell_run tool definition; Tracer-Cloud/opensre on GitHub: commit ae5d449, 'refactor(tools): tighten tool execution defaults (#6631)' | high |
| Action | The agent runs the attacker's commands on the host without confirmation, exposing LLM, Slack and cloud credentials to exfiltration | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | high |
| Outcome | State: pending (no fix has shipped). No exploitation in the wild is reported in the sources; Lasso Security lists no known exploit. The reporters demonstrated the flaw in their own test setup: with a stubbed model, and with local models run through Ollama reading a forwarded Grafana alert carrying planted instructions, shell_run commands ran with no approval prompt (qwen3:8b emitted the injected command in 2 of 3 runs; llama3.1:8b did not use the tool channel). Lasso Security reports that the injected command was persisted to the agent's cross-session memory, with automatic re-execution seen once and not reproduced, so unconfirmed. The CISA (Cybersecurity and Infrastructure Security Agency) enrichment of the CVE record marks exploitation as 'poc', a proof of concept. As of 21 October 2026. | assertion | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7; Lasso Security vulnerability database, 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection' | medium |
| Evidence: event | CVE-2026-109444 published 20 October 2026 by the VulnCheck CNA (CVE Numbering Authority); CVSS 4.0 8.7 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H), CVSS 3.1 8.8; CWE-862 (Common Weakness Enumeration: missing authorization); references OpenSRE source at commit 8eba8c9 (Slack dispatcher and subprocess_presenter.py), a VulnCheck advisory dated 19 October 2026 and Lasso Security's advisory; credits Noy Pearl, Michael Sromin and Ophir Dror as finders; gives 15 October 2026 as the date the flaw was made public. On 20 October 2026 CISA's enrichment of the record added Exploitation 'poc', Automatable 'yes', Technical Impact 'total' | fact | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7; VulnCheck advisory, 'OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection' | high |
| Recovery: technical | No fix had shipped as of 21 October 2026: the CVE record lists versions through 0.1.2026.10.19 as affected and names no fixed version, and in OpenSRE's code at version 0.1.2026.10.21, the latest tag on 21 October 2026, the headless presenter's execution_allowed() still returns True. Lasso Security recommends requiring approval for shell_run and cli_exec, failing closed on headless surfaces when no approver is available, and treating observability content as untrusted data | assertion | Lasso Security vulnerability database, 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection'; NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7; Tracer-Cloud/opensre on GitHub: tools/interactive_shell/subprocess_presenter.py at tag v0.1.2026.10.21 | medium |
| Recovery: accountability | not evidenced in source | assertion | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | low |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Mechanism: shell_run is meant to require confirmation (the project's code at the affected commit marks it requires_approval=True; Lasso Security's write-up says it never opted into the gate), but in headless mode the presenter's execution_allowed() always returns True, so commands the agent derives from injected alert or Slack text run without confirmation. Why it interrupts: a confirmation step that is enforced on every surface would put a human decision between the injected instruction and the host command. Source shows it failed: the record calls this an approval gate bypass and states commands run without confirmation. | C-E3 Destructive-action gate |
| failed | Mechanism: when no human approver is present (the headless presenter), the presenter's code allows the command rather than stopping. Why it interrupts: stopping and handing off when the approval cannot be obtained would have blocked the command even with the injected instruction accepted. Source shows it failed: execution_allowed() always returns True in headless mode. The source does not show a fail-closed configuration being tried, so the counterfactual is not shown. | C-D2 Halt and hand off on uncertainty or refusal |
| failed | Mechanism: the record names injected instructions in alerts or Slack messages, which the agent reads while triaging, as the route to command execution. Why it interrupts: if text read during triage were treated only as data, the planted instruction would not become a shell_run call. Source shows it failed: the agent acts on instructions planted in the content it triages. | C-I1 Retrieved content as data |
Inference
inference The record shows an approval step that does not stop a command when no person is there to answer: on headless surfaces such as the gateway and scheduled runs, the presenter's execution_allowed() always returns True, allowing the command, so a shell command prompted by text planted in an alert or Slack message can run without anyone deciding it. The reporters demonstrated this with a planted alert in their own test setup, where whether the model acted on the planted text varied by model and run. The record does not show exploitation in the wild, does not confirm that a planted command stored in the agent's memory runs again later, and shows no fix as of 21 October 2026.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| NVD-109444 | NVD record CVE-2026-109444: OpenSRE through 0.1.2026.10.19, approval gate bypass on shell_run in headless mode (execution_allowed() always True); injected alert or Slack instructions run host commands, CVSS 4.0 8.7 | public record primary record | nvd.nist.gov ↗ checked 2026-10-21 |
| LASSO-109444 | Lasso Security vulnerability database, 'CVE-2026-109444: Remote Code Execution via Ungated shell_run Tool Driven by Prompt Injection' (interest: Security vendor that publishes the entry and sells AI security products) | researcher primary record | lasso.security ↗ checked 2026-10-21 |
| VC-109444 | VulnCheck advisory, 'OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection' | researcher primary record | vulncheck.com ↗ checked 2026-10-21 |
| REPO-AE5D449 | Tracer-Cloud/opensre on GitHub: commit ae5d449, 'refactor(tools): tighten tool execution defaults (#6631)' (interest: maintainer's own repository) | company primary record | github.com ↗ checked 2026-10-21 |
| REPO-SHELL-1019 | Tracer-Cloud/opensre on GitHub: tools/interactive_shell/actions/shell.py at commit 8eba8c9 (tag v0.1.2026.10.19), shell_run tool definition (interest: maintainer's own repository) | company primary record | github.com ↗ checked 2026-10-21 |
| REPO-PRESENTER-1021 | Tracer-Cloud/opensre on GitHub: tools/interactive_shell/subprocess_presenter.py at tag v0.1.2026.10.21 (interest: maintainer's own repository) | company primary record | github.com ↗ checked 2026-10-21 |