OpenSRE Approval Gate Bypass Vulnerability

OpenSRE versions through 0.1.2026.10.19 contain a critical vulnerability in the headless presenter component. The application’s execution_allowed() function incorrectly returns a constant value of True, effectively bypassing the security controls designed to gate automated command execution. This flaw allows an attacker to inject arbitrary system commands through inputs typically processed by the agent, such as alerts or Slack messages. If successful, the attacker can execute commands on the underlying host, facilitating unauthorized actions such as the exfiltration of sensitive LLM configuration, Slack tokens, and cloud environment credentials. This vulnerability is particularly impactful for organizations relying on automated remediation or incident response workflows within OpenSRE.

Impact

Successful exploitation allows for full command execution on the host machine running the OpenSRE agent. This access exposes the organization to significant risk, including the compromise of cloud infrastructure, theft of API and platform-specific credentials, and potential pivoting into internal networks. The vulnerability affects all deployments of OpenSRE through version 0.1.2026.10.19.

Recommendation

Prioritized actions for detection engineering and security operations teams:

• Upgrade all instances of OpenSRE to a version beyond 0.1.2026.10.19 immediately.
• Audit logs for the execution of shell_run or equivalent command-line functions originating from the OpenSRE process context.
• Restrict the permissions of the user account running the OpenSRE agent to the principle of least privilege, specifically limiting access to environment variables, credentials, and cloud metadata services.