Security1 hOctober 21, 2026, 18:10

OpenSRE flaw lets headless agents run shell commands without approval

CVE-2026-109444 (CVSS 8.8) in the AI SRE agent OpenSRE through 0.1.2026.10.19 lets attackers run shell commands without confirmation because the headless presenter's execution_allowed() always returns True. Injected instructions in alerts or Slack messages can lead to command execution and theft of LLM, Slack and cloud credentials. No fixed release is listed.

DEV Community

Open source

OpenSRE flaw lets headless agents run shell commands without approval

CVSS 3.1 score 8.8, CWE-862 missing authorization
HeadlessSubprocessPresenter discards policy and returns True
Slack dispatcher disables approval prompts with tool_hooks=None
No fixed release; credited to Noy Pearl, Michael Sromin and Ophir Dror

#OpenSRE#Slack

Vibe-Trading flaw lets prompt injection run root shell commands

Security

MaxKB's CVSS 10.0 CVE: Patch Fixed Shell Quoting, Not the Approval Gate

Policy

CBS: CMS's 1,700-member Slack lets Microsoft, OpenAI shape AI and medical records policy

Software

OpenSRE flaw lets headless agents run shell commands without approval

Vibe-Trading flaw lets prompt injection run root shell commands

MaxKB's CVSS 10.0 CVE: Patch Fixed Shell Quoting, Not the Approval Gate

CBS: CMS's 1,700-member Slack lets Microsoft, OpenAI shape AI and medical records policy

Codex CLI 0.158: approval for elevated commands and MCP OAuth client secrets