Vulnerability · Published Oct 20, 2026 · Assigned by VulnCheck

CVE-2026-109444OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection

Critical 9.8

In plain English

A critical-severity missing authorization in opensre from Tracer-Cloud. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.

Affected products (as reported)

Vendor	Product	Versions
Tracer-Cloud	opensre	0 – through 0.1.2026.10.19

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Lasso.security Advisory technical-description, exploit
https://github.com/Tracer-Cloud/opensre/blob/8eba8c9301fa954d9eecb1693b7e2021215ec2ec/tools/interactive_shell/subprocess_presenter.py#L41 technical-description
https://github.com/Tracer-Cloud/opensre/blob/8eba8c9301fa954d9eecb1693b7e2021215ec2ec/gateway/transports/slack/processing/dispatcher.py#L276 technical-description
VulnCheck Advisory: OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection third-party-advisory