The same remediation agent reads externally influenced alert text and can execute host commands. An approval feature protects only calls routed through an enforcing path; a tool label or unused callback supplies no such boundary. Mechanism, preconditions and effects. OpenSRE's incident-triage agent ingests potentially attacker-controlled alert…
Inspect the ClaimsCase · DiggingBeagle record
OpenSRE alert text can reach a shell tool that never requests approval
Scope
Reported action-agent and non-interactive execution paths; attacker influence over ingested alerts is required for the injection route.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-OPENSRE-UNGATED-SHELL reports: The OpenSRE advisory reports that shell_run and cli_exec inherit requires_approval=False, while the headless presenter also automatically permits execution and discards the confirmation callback. Source SRC-2026-RADAR-OPENSRE-UNGATED-SHELL is located at 'Root Cause; tool contracts, shell actions and headless subprocess presenter'. The distinctive mechanism begins: OpenSRE's incident-triage agent ingests potentially attacker-controlled alert descriptions. Classification: setting=research_demonstration, exploit_status=demonstrated, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Mark shell and CLI tools as approval-required, make headless approval fail closed, narrow process credentials and outbound reachability, and separate untrusted observability text from executable tool decisions. A generic allowlist shown to the model does not govern a shell tool that is already registered. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-OPENSRE-UNGATED-SHELL · OpenSRE CVE-2026-109444 approval-path analysis
At a glance
The report does not establish a production intrusion or this run's independent reproduction.
Limits and uncertaintyFull account
The same remediation agent reads externally influenced alert text and can execute host commands. An approval feature protects only calls routed through an enforcing path; a tool label or unused callback supplies no such boundary.
Mechanism, preconditions and effects. OpenSRE's incident-triage agent ingests potentially attacker-controlled alert descriptions. The shell_run and cli_exec tools retain requires_approval=False, and headless gateway/scheduled execution installs a presenter that allows commands without interactive confirmation. The local model experiments show crafted Grafana text inducing shell calls and execution as the SRE process user, with the process environment inherited by the shell.
Comparison and evidence limits. A deterministic test also established the tool-execution path without an LLM; selected Qwen model runs supplied the prompt-injection behavior. A stored memory entry was observed, but automatic execution on a later clean alert happened once and failed to reproduce twice. The report provides no verified victim estate compromise.
Claims & evidence
CLM-OPENSRE-UNGATED-SHELLThe OpenSRE advisory reports that shell_run and cli_exec inherit requires_approval=False, while the headless presenter also automatically permits execution and discards the confirmation callback.supported
Basis: reported finding
- supportsOpenSRE CVE-2026-109444 approval-path analysisprimary disclosure
Root Cause; tool contracts, shell actions and headless subprocess presenter
Controls and mitigations
- Mark shell and CLI tools as approval-required, make headless approval fail closed, narrow process credentials and outbound reachability, and separate untrusted observability text from executable tool decisions. A generic allowlist shown to the model does not govern a shell tool that is already registered.
Unknowns and contradictions
- The report does not establish a production intrusion or this run's independent reproduction.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183