AI Agents: Human Approval Bypassed in EvoScientist, OpenSRE and Vibe-Trading (CVE-2026-77930, 109444, 114108)

On October 20 and 21, 2026, NVD published three CVEs rated 9.8 in open source AI agents: EvoScientist, OpenSRE and Vibe-Trading (HKUDS). VulnCheck assigned all three.

Two days ago we covered five agent platforms whose API was open to anyone. This batch is more instructive: in two of the three cases, the API doesn't even need to be exposed. The safeguard that's supposed to ask for your OK before each command simply doesn't do its job, and the content the agent reads is enough to drive it.

All three CVSS 3.1 scores come from VulnCheck (CNA), with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; VulnCheck also rates each one 9.3 under CVSS 4.0. NVD hasn't analyzed them: all three are Deferred. None is in CISA KEV at the time of writing.

EvoScientist — CVE-2026-77930

EvoScientist asks a human to approve shell commands before they run. The catch: that gate (the interrupt_on setting) isn't applied to async sub-agents.

According to the NVD description, an attacker only needs to plant instructions in content the agent ingests, such as a fetched web page. The agent then calls start_async_task, hands the command to a sub-agent, and it runs with the user's privileges and environment secrets. The confirmation prompt never shows up.

NVD's references point to version 0.2.5, the first release outside the range, and to the fixing commit.

OpenSRE — CVE-2026-109444

OpenSRE is an agent that triages operational alerts. In headless mode, the presenter's execution_allowed() function always returns True, so the shell_run tool executes with no confirmation at all.

The attack path NVD describes says it all: inject instructions into an alert or a Slack message the agent is going to triage. It runs the commands on the host and can exfiltrate LLM, Slack and cloud credentials. For an SRE tool, wired by design into monitoring and cloud accounts, that's about as bad as it gets.

NVD lists "up to and including 0.1.2026.10.19" with no fixed version.

Vibe-Trading — CVE-2026-114108

No injection needed here. The FastAPI app's require_auth() returns early when API_AUTH_KEY is unset, which leaves the entire API open. An unauthenticated attacker can:

• post to /sessions/{id}/messages to have the BashTool run shell commands as root;
• upload .py or .sh files through /upload;
• read session histories and pull partial API keys.

Per the description, the first release outside the range is 0.1.7.

What This Batch Teaches

1. Human approval is only a control if it covers every path. EvoScientist's async path slips past it; OpenSRE's headless mode switches it off. A control that depends on the execution mode or call path is something to test, not assume.
2. Anything the agent reads is attacker input. A web page, an alert, a Slack message: if the agent reads it and can act, whoever wrote it can act too. That's indirect prompt injection, and it doesn't need an open port.
3. "Secure once configured" means open by default. Vibe-Trading repeats the pattern we saw with Letta and Cognition: authentication hinges on a variable nobody remembered to set.

These are inferences drawn from the NVD descriptions: no exploitation is documented in the references so far.

Versions

• EvoScientist: move to 0.2.5 or later (the version NVD references).
• Vibe-Trading: move to 0.1.7 or later, and set API_AUTH_KEY anyway.
• OpenSRE: NVD gives no fixed version. Check the Tracer-Cloud/opensre repository and the VulnCheck advisory listed in the references.

These come from the NVD description: they're range bounds, not necessarily the version to install. Read the release notes.

Detection

• Inventory: these tools tend to land on a developer laptop or a test VM. Look for evoscientist and opensre Python processes and Vibe-Trading's FastAPI service.
• Vibe-Trading: requests to /sessions/*/messages or /upload from unknown IPs; no API_AUTH_KEY in the environment.
• OpenSRE: shell commands spawned by the agent process that don't match any expected triage action; alerts or Slack messages containing natural-language instructions addressed to the agent.
• EvoScientist: start_async_task calls in agent logs right after a web page was fetched.
• LLM and cloud billing: unusual usage on any key present in the environment.

Mitigation

1. Update EvoScientist and Vibe-Trading to the versions above.
2. OpenSRE: don't run headless mode with shell_run enabled until a fix ships, and restrict the sources (Slack channels, alert feeds) the agent processes.
3. Give agents as few secrets as possible: no admin cloud credentials in their environment, dedicated and capped LLM API keys.
4. Isolate execution: an unprivileged container with no route to the internal network, not the host or a developer's machine.
5. If an agent on a vulnerable version read untrusted content: assume its secrets are exposed and rotate them.

Why Continuous Monitoring of Your AI Agents Matters

These projects ship a new version every week and get installed outside any review process. Three critical CVEs in two days, one with no fix at all: without an inventory, you can't tell which ones run in your environment, or with which secrets.

With cveo.tech, add your AI tools to your inventory and get an alert as soon as a critical CVE hits them.