CVE-2026-109444: Missing Authorization in Tracer-Cloud opensre

OpenSRE versions up to 0.1.2026.10.19 contain an approval gate bypass vulnerability (CVE-2026-109444) that permits unauthorized execution of shell_run commands. The root cause is that the headless presenter's execution_allowed() method always returns True, effectively disabling the intended confirmation step. Attackers can exploit this by injecting commands into alerts or Slack messages triaged by the agent, which are then executed on the host. This can result in exfiltration of sensitive credentials including LLM, Slack, and cloud credentials. The vulnerability has a CVSS 4.0 score of 8.7, indicating high severity. No known exploits in the wild or patches are currently documented.

Successful exploitation allows attackers to execute arbitrary shell commands on the host without user confirmation, leading to potential credential theft and unauthorized access to sensitive systems and data. The vulnerability compromises the security of the approval mechanism, increasing risk of privilege escalation and data exfiltration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected system and monitor for suspicious alert or Slack message activity that could trigger command execution. Avoid using untrusted inputs in alerts or Slack messages processed by the agent.