CVE-2026-109444: OpenSRE Approval Gate Bypass — Detection and Remediation Guide for Agentic AI Deployments

---
title: OpenSRE Agent Spawning Shell or Command Interpreter
description: Detects the OpenSRE process spawning shell interpreters or command execution utilities, consistent with CVE-2026-109444 approval gate bypass leading to unauthorized shell_run execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109444
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'opensre'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Documented OpenSRE remediation playbooks that legitimately invoke shells; baseline approved tool invocations and alert on deviations
level: high
---
title: Credential or Secret File Access Following Agent Shell Execution
description: Detects shell commands spawned under OpenSRE that reference cloud credential files, environment dumps, or Slack/LLM token locations, indicating exfiltration after CVE-2026-109444 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109444
  - https://attack.mitre.org/techniques/T1552/
author: Security Arsenal
status: experimental
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'opensre'
  selection_creds:
    CommandLine|contains:
      - '.aws/credentials'
      - '.config/gcloud'
      - 'metadata.google.internal'
      - '169.254.169.254'
      - '/proc/self/environ'
      - '/proc/1/environ'
      - 'printenv'
      - ' SLACK_'
      - 'OPENAI_API_KEY'
      - 'ANTHROPIC_API_KEY'
      - 'AWS_SECRET'
      - '.env'
  condition: selection_parent and selection_creds
falsepositives:
  - Agent health checks reading its own configuration; restrict to the exact config path the agent legitimately reads and alert on everything else
level: critical
---
title: OpenSRE Process Initiating Outbound Connection to Non-LLM Destination
description: Detects network connections from shells spawned by OpenSRE to external hosts, a strong exfiltration indicator when the destination is not an approved LLM API or Slack endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109444
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
status: experimental
logsource:
  category: network_connection
  product: linux
detection:
  selection_parent:
    ParentImage|contains: 'opensre'
  selection_net:
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python3'
  filter_approved:
    DestinationHostname|contains:
      - 'api.openai.com'
      - 'api.anthropic.com'
      - 'slack.com'
      - 'amazonaws.com'
  condition: selection_parent and selection_net and not filter_approved
falsepositives:
  - New SaaS integrations added to the agent; maintain the approved-destination allowlist as a living document
level: high

// Hunt: OpenSRE shell_run abuse — CVE-2026-109444
// Looks for (1) shells spawned by opensre, (2) credential/token access, (3) suspect outbound connections
let credArtifacts = dynamic([".aws/credentials", ".config/gcloud", "169.254.169.254",
    "metadata.google.internal", "/proc/self/environ", "/proc/1/environ",
    "printenv", "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "AWS_SECRET", "SLACK_BOT_TOKEN", ".env"]);
let shellBinaries = dynamic(["/bin/sh", "/bin/bash", "/usr/bin/curl", "/usr/bin/wget", "/usr/bin/nc", "python3"]);
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has "opensre" or ProcessName in~ ("sh", "bash", "curl", "wget", "nc", "python3")
| extend Raw = tostring(SyslogMessage)
| extend ShellSpawn = Raw has_any (shellBinaries)
| extend CredAccess = Raw has_any (credArtifacts)
| where ShellSpawn or CredAccess
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    SampleCommands = make_set(strcat("[", ProcessName, "] ", substring(Raw, 0, 300)), 20)
  by Computer, SeverityLevel = iif(CredAccess, "CRITICAL", "HIGH")
| order by LastSeen desc
;
// Companion query: network exfil from agent hosts via CEF/syslog firewall feeds
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DeviceAction !in~ ("deny", "drop")
| where SourceHostName has "opensre" or SourceUserName has "opensre"
| where DestinationHostName !has_any ("api.openai.com", "api.anthropic.com", "slack.com")
| summarize BytesOut = sum(tolong(SentBytes)), Connections = count()
  by SourceIP, DestinationIP, DestinationHostName, DestinationPort
| where BytesOut > 100000 or Connections > 50
| order by BytesOut desc

-- Artifact: Custom.Hunt.OpenSRE.ApprovalBypass
-- Purpose: Detect shell_run abuse on hosts running OpenSRE (CVE-2026-109444)
-- Looks for opensre processes with shell/utility children touching credentials or network tools

LET agent_procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'opensre' OR Name =~ 'opensre'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|zsh|curl|wget|nc|ncat|python3?)$'
  AND (
    CommandLine =~ '(?i)(\.aws/credentials|\.config/gcloud|169\.254\.169\.254|metadata\.google|/proc/(self|1)/environ|printenv|API_KEY|SLACK.*TOKEN|AWS_SECRET|\.env)'
  )

-- Also capture current outbound connections from the host for triage context
LET net_conns = SELECT Pid, Name, LocalIP, LocalPort, RemoteIP, RemotePort, State
FROM netstat()
WHERE State =~ 'ESTABLISHED' AND NOT RemoteIP =~ '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)'

SELECT * FROM agent_procs
UNION ALL
SELECT * FROM suspicious_children

#!/usr/bin/env bash
# CVE-2026-109444 — OpenSRE approval gate bypass: verify and harden
# Run as root or with sudo on each host running OpenSRE.
set -euo pipefail

AFFECTED_CEILING="0.1.2026.10.19"
echo "=== CVE-2026-109444 OpenSRE Verification ==="

# 1. Locate the installed version
if command -v opensre >/dev/null 2>&1; then
  INSTALLED=$(opensre --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]{4}\.[0-9]{2}\.[0-9]{2}' | head -1 || true)
  echo "[+] Installed OpenSRE version: ${INSTALLED:-unknown}"
else
  echo "[-] opensre binary not in PATH; checking pip installs..."
  INSTALLED=$(pip3 show opensre 2>/dev/null | awk '/^Version/{print $2}' || true)
  echo "[+] pip-reported version: ${INSTALLED:-not found}"
fi

# 2. Check for the vulnerable code path directly
VULN_FILES=$(grep -rl "def execution_allowed" \
  /usr/lib/python3*/site-packages/opensre* \
  /usr/local/lib/python3*/site-packages/opensre* \
  ~/.local/lib/python3*/site-packages/opensre* 2>/dev/null || true)
for f in $VULN_FILES; do
  if grep -A2 "def execution_allowed" "$f" | grep -q "return True"; then
    echo "[!] VULNERABLE CODE PATH CONFIRMED in: $f"
    echo "    execution_allowed() unconditionally returns True — approval gate is bypassed."
  fi
done

# 3. Compensating control: run the agent with a dedicated low-privilege user
if id opensre-svc >/dev/null 2>&1; then
  echo "[+] Service account opensre-svc already exists"
else
  useradd --system --no-create-home --shell /usr/sbin/nologin opensre-svc
  echo "[+] Created low-privilege service account: opensre-svc"
fi

# 4. Remove cloud/LLM/Slack credentials from the agent's environment scope
SVC_USER="opensre-svc"
echo "[*] Auditing credential exposure for ${SVC_USER}..."
sudo -u "$SVC_USER" bash -c '
  for p in ~/.aws/credentials ~/.config/gcloud ~/.env; do
    [ -e "$p" ] && echo "[!] EXPOSED: $p readable by agent account — relocate or remove"
  done
  env | grep -iE "(API_KEY|TOKEN|SECRET|AWS_)" | sed "s/=.*/=<REDACTED>/" \
    && echo "[!] Secrets present in agent environment — move to a secrets manager"
' || true

# 5. Network egress restriction: allow only approved LLM/Slack endpoints
# Adjust the allowlist to your providers. Requires iptables and a dedicated egress group.
echo "[*] Apply egress filtering so ${SVC_USER} can only reach approved endpoints."
echo "    Example (DNS-allowlist via your egress proxy/firewall is preferred over IP rules):"
echo "      - api.openai.com / api.anthropic.com"
echo "      - *.slack.com"
echo "      - your cloud provider control plane endpoints only"

# 6. Upgrade instruction
echo ""
echo "=== ACTION REQUIRED ==="
echo "If version <= ${AFFECTED_CEILING} or vulnerable code path confirmed:"
echo "  1. Upgrade OpenSRE to the fixed release immediately: pip3 install --upgrade opensre"
echo "  2. If no fix is available, DISABLE headless/autonomous mode and require"
      "     interactive presenter approval for all shell_run invocations."
echo "  3. Rotate ALL credentials the agent could access: LLM API keys, Slack tokens,"
      "     cloud IAM keys/roles. Assume compromise until proven otherwise."