Tracer-Cloud vulnerabilities
Published CVEs affecting Tracer-Cloud products: 1 record(s), with severity, exploitation and fixes.
CVE-2026-109444
High · 8.8
CWE-862 Oct 19, 2026
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.