CVE-2026-90999 Overview
CVE-2026-90999 is a multi-stage trust-boundary violation in Sentry Seer. The flaw allows unauthenticated, attacker-controlled telemetry to be transformed into executable code that runs inside an agent operating in a privileged automation environment. An external attacker can submit fabricated Sentry events without holding access to the victim's Sentry account, source repository, or infrastructure. The result is that untrusted input crosses several implicit trust boundaries and reaches a component that executes it with elevated privileges. CERT/CC tracks this issue under Vulnerability Note VU#212479.
Critical Impact
Remote, unauthenticated attackers can achieve code execution inside a privileged automation agent by submitting fabricated telemetry to Sentry Seer.
Affected Products
- Sentry Seer
- Automation agents integrated with Sentry Seer telemetry pipelines
- Environments that grant Seer-driven agents privileged access to source repositories or infrastructure
Discovery Timeline
- 2026-09-16 - CVE-2026-90999 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90999
Vulnerability Analysis
Sentry Seer is an AI-assisted component that consumes telemetry events, reasons about them, and drives automated actions through an agent. CVE-2026-90999 describes a chain in which data crosses several trust boundaries without re-validation. Telemetry submitted at the perimeter is treated by downstream components as trustworthy context. The agent then converts that context into actions, including code that executes in a privileged automation environment.
The defect is a design-level trust-boundary violation. Ingested Sentry events are not isolated from the agent's execution surface, so attacker-supplied fields influence what the agent runs. Because Sentry accepts event submissions from external clients, the attacker does not need credentials for the victim tenant, repository, or infrastructure to reach the vulnerable path.
Root Cause
The root cause is failure to enforce a trust boundary between externally sourced telemetry and the agent's action-planning and execution layer. Attacker-controlled strings within event payloads are consumed by an AI-driven agent that treats them as authoritative instructions or context. When those instructions are materialized as code or commands in an automation runner, the agent executes them with the runner's privileges.
Attack Vector
An external attacker submits fabricated Sentry events to a project that feeds Seer. The events contain crafted content designed to steer Seer's automated agent. When the agent processes the event and takes downstream action, the attacker's payload executes inside the privileged automation environment. See the CERT Vulnerability Advisory #212479 for the full technical description, affected configurations, and vendor status.
No verified exploit code is published in the referenced sources, so exploitation specifics are omitted here.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-90999
Indicators of Compromise
- Unexpected Sentry events originating from unknown source IPs or from projects that do not normally receive external submissions.
- Seer agent runs that spawn shells, package installers, or outbound network connections not tied to a legitimate incident.
- Unexplained commits, pull requests, or CI job invocations initiated by the Seer automation identity.
Detection Strategies
- Correlate Sentry event ingestion logs with subsequent Seer agent actions to flag runs driven by externally submitted events.
- Alert on Seer agent processes that execute code paths or tool calls outside an approved allowlist.
- Baseline the automation runner's normal syscall, process, and network behavior, then alert on deviations tied to a Seer session.
Monitoring Recommendations
- Forward Sentry ingestion logs, Seer agent transcripts, and automation runner audit logs to a central analytics pipeline for joined analysis.
- Monitor privileged tokens issued to the Seer agent for use outside expected repositories, branches, and infrastructure targets.
- Track rate and diversity of inbound Sentry events per project to identify prompt-injection style flooding.
How to Mitigate CVE-2026-90999
Immediate Actions Required
- Disable Seer-driven automation for projects that accept unauthenticated or externally reachable event submission until a fix is applied.
- Rotate credentials, tokens, and SSH keys held by the Seer automation identity and any runners it can reach.
- Review recent Seer agent activity for unauthorized code changes, deployments, or infrastructure calls.
Patch Information
Refer to the CERT Vulnerability Advisory #212479 for authoritative vendor status and remediation guidance. No fixed version was recorded in the NVD entry at publication time, so administrators should track the CERT/CC note and vendor advisories for updates.
Workarounds
- Restrict Sentry event submission to authenticated, trusted sources and drop events from unknown ingest keys.
- Run the Seer agent in a sandboxed environment with least-privilege tokens scoped to a single repository or namespace.
- Require human approval before the Seer agent can execute code, open pull requests, or modify infrastructure.
- Strip or neutralize free-form fields from telemetry before they reach the agent's reasoning context.
# Configuration example
# Refer to the CERT/CC advisory for vendor-supplied configuration guidance:
# https://kb.cert.org/vuls/id/212479
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
