OpenSRE: Approval gate bypass via shell_run prompt injection

Summary

OpenSRE, an AI site-reliability agent, executes the shell_run tool without the confirmation step on headless surfaces such as the Slack gateway and scheduled runs, because the headless presenter's execution_allowed() always returns True. An attacker who can inject instructions into alerts or Slack messages that the agent triages can run commands on the host and exfiltrate LLM, Slack and cloud credentials. No login to OpenSRE is required, and the impact is high if the agent holds broad cloud or LLM credentials.

Affected

• Tracer-Cloud OpenSRE through 0.1.2026.10.19
• Headless or non-interactive use (Slack gateway, scheduled runs, embedded use)

Fixed in

Unknown.

Workaround

• Set requires_approval=True on shell_run and cli_exec, as recommended by Lasso
• Treat headless surfaces as executing shell_run without confirmation and restrict them accordingly
• Restrict the credentials and network reach of the host account
• Limit which alert sources and Slack channels can feed the agent

Exploitation

• Known exploited in the wild: no evidence found, not listed in CISA KEV
• Public proof of concept: none found; CISA SSVC lists exploitation as poc and automatable as yes
• The CVE was published on 20 October 2026, so the status may change quickly

Our recommendation

• Ask whether OpenSRE is in use and check the deployed version
• Enable approval on shell_run and cli_exec and limit the alert and Slack inputs the agent processes
• Restrict the agent's cloud and LLM credentials to the minimum needed
• Monitor the GitHub advisory and VulnCheck for a fixed release, and check GitHub issue #6373 for the related execute_python_code path

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE record context: VulnCheck advisory www.vulncheck.com
• Lasso vulnerability database entry www.lasso.security
• OpenSRE dispatcher.py at the referenced commit github.com
• OpenSRE subprocess_presenter.py at the referenced commit github.com
• OSV entry via Vulners vulners.com
• VulDB CVE entry vuldb.com
• OpenSRE issue #6373 (execute_python_code) github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:13.