Lasso Security discloses OpenSRE CVE-2026-109444: forwarded alert text can inject instructions, causing the Agent to execute shell commands without approval
Lasso Security disclosed CVE-2026-109444 for OpenSRE (Tracer-Cloud/opensre) in a vulnerability database: an attacker can hide instructions in forwarded Grafana or Loki alert text, causing the operations Agent to execute arbitrary shell commands on the host machine, with no authentication and no human approval required. The root cause is that shell_run and cli_exec do not set requires_approval, and in non-interactive scenarios such as gateways and scheduled tasks the approval gate is unconditionally bypassed; the subprocess environment is also copied from the full os.environ, so a single command can read out the LLM API key, DATABASE_URL, Grafana, Datadog, Slack token and cloud credentials. The recommendation is to enable approval for shell_run and cli_exec, have non-interactive scenarios refuse execution when there is no approver, add a whitelist to the shell policy and narrow the subprocess environment variables.
The disclosure provides the specific code path for approval-free shell execution and a reproducible PoC, which teams deploying this operations Agent can use to check whether alert text is being treated as trusted instructions.