CVE-2026-109444: opensre 0 through 0.1.2026.10.19

Affected technology

opensre · 0 through 0.1.2026.10.19
Tracer-Cloud

Description’s affected range: through 0.1.2026.10.19

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Passive user interaction

What an attacker can do

Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.