OpenSRE Approval Gate Bypass via shell_run Prompt Injection
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
OpenSRE through 0.1.2026.10.19 lets attackers run shell_run commands without confirmation, because the headless presenter's execution_allowed() always returns True. An attacker can inject instructions into alerts or Slack messages that the agent triages, then run commands on the host and exfiltrate LLM, Slack and cloud credentials. The flaw is classified as CWE-862 Missing Authorization and scored 9.3 CRITICAL under CVSS 4.0. A public proof of concept exists, CISA SSVC rates it automatable with total technical impact, and it is not in CISA KEV.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Tracer-Cloud | opensre | up to 0.1.2026.10.19 | — | No fix listed | CNA |
- opensre VendorTracer-Cloud Affected up to 0.1.2026.10.19 Fixed in — No fix listed CNA
Remediation
No fixed version is listed for Tracer-Cloud's opensre. Until a fixed release is available, remove shell_run from the agent's tools or require manual approval before it runs, and treat alert and Slack content as untrusted input.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Timeline
- 2026-10-20 Threatist record created from CVE-2026-109444
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: MEDIUM → HIGH
- 2026-10-23 CVSS score changed · CNA
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Exploit 1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences