CVE-2026-109444 Details

A vulnerability in OpenSRE versions through 0.1.2026.10.19 allows for an approval gate bypass, enabling attackers to execute commands on the host without confirmation. This is possible because the headless presenter's 'execution_allowed()' method always returns True. Exploitation involves injecting instructions into alerts or Slack messages that are processed by the OpenSRE agent. The executed commands can access and exfiltrate sensitive credentials from the environment, including those related to LLMs, Slack, and cloud services.

To address this vulnerability, set 'requires_approval' to True for the 'shell_run' and 'cli_exec' tools. Additionally, stop discarding the confirmation function in the 'headless_subprocess_presenter_factory', and ensure that non-TTY surfaces fail closed when no approver is available. It is also recommended to add an allow-list or deny floor to the shell policy, scope the child process environment to exclude sensitive secrets, and treat data from observability sources as untrusted.