CVE-2026-90999

Executive Summary

CVE-2026-90999 affects Sentry Seer, the AI-assisted issue triage and agent component of the Sentry observability platform. The vulnerability is a multi-stage trust-boundary violation in which unauthenticated, attacker-supplied telemetry (fabricated Sentry events) is accepted, processed, and ultimately converted into code that is executed by an agent running in a privileged automation environment. No authentication to the victim's Sentry account, source repository, or infrastructure is required, making the attack surface effectively anonymous and remotely reachable.

As of this writing, no CVSS score, CWE assignment, affected version range, EPSS score, patch, or workaround has been published. There is no public proof-of-concept, no Nuclei template, and no evidence of CISA KEV inclusion. The combination of unauthenticated input, a privileged downstream execution context, and zero available remediation makes this a high-priority architectural risk for any organization that ingests external telemetry into an agent-driven automation pipeline.

Technical Analysis

The core defect is a trust-boundary violation of the CWE-501 class. A trust boundary exists wherever data crosses from a lower-privilege domain (untrusted external telemetry) into a higher-privilege domain (an agent executing within a privileged automation environment). The NVD description states that this boundary is violated across multiple stages — meaning the untrusted data is not rejected at ingest, is not adequately sanitized during intermediate processing, and is finally consumed as executable logic by the downstream agent.

The attack surface is the event ingestion path of Sentry Seer. Sentry is normally used to collect error and performance telemetry from instrumented applications. Ingestion endpoints are by design reachable by clients that hold a project DSN (client key) but not necessarily full account credentials. The NVD description explicitly notes the attacker does not need access to the victim's Sentry account, source repository, or infrastructure — only the ability to submit fabricated events. This implies the ingestion endpoint is either publicly reachable or reachable with a low-privilege credential, and that the agent pipeline trusts event content originating from it.

The "multi-stage" characterization describes a pipeline rather than a single function. At the vulnerability-class level the chain is:

1. Stage 1 — Untrusted ingest: Attacker-controlled content is embedded in a fabricated event.
2. Stage 2 — Insufficient validation/neutralization: The pipeline does not distinguish attacker-originated telemetry from internally-generated telemetry, and does not sanitize the content before it is passed downstream.
3. Stage 3 — Confused-deputy execution: A Seer agent operating in a privileged automation context consumes the event content as instructions or code and executes it.

No specific endpoint paths, parameter names, function names, or code identifiers are provided in the CNA title or NVD description; accordingly, no such identifiers are asserted here. The precise injection syntax, the exact event field abused, and the execution primitive used by the agent are not disclosed in the available data. Any claim about a specific payload format for this CVE would be speculation.

What is authoritative: the class (trust-boundary violation), the pre-auth nature, the multi-stage pipeline abuse, and the terminal effect (agent-executed code in a privileged environment). What is not authoritative: version ranges, CVSS, CWE, PoC, and any implementation-level detail.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class and the NVD description, and deliberately avoids fabricating implementation specifics.

1) Reconnaissance / target identification. The attacker identifies an organization that operates Sentry Seer with an agent that is wired into a privileged automation environment (for example, a pipeline that can read repositories, modify code, or invoke deployment actions). The attacker needs to locate the relevant Sentry ingestion surface — either a publicly reachable ingestion endpoint or a low-privilege client key (DSN) that permits event submission. Because the flaw requires no account access, the attacker does not need to phish, steal credentials, or compromise the source repository first.

2) Triggering the flaw class. The attacker submits one or more fabricated Sentry events to the ingestion surface. The content of those events is attacker-controlled and is crafted to carry a payload through the pipeline. The trust-boundary violation means the pipeline treats the externally-originated event as trustworthy — it is neither flagged as external nor sanitized before it is forwarded to the agent stage. No authentication to the victim's Sentry account is required at any point.

3) Payload / execution method (class level). At the final stage, the agent consumes the event content and treats it as instructions or code. When the agent acts on that content inside its privileged automation environment, the attacker's payload executes with the agent's privileges. In trust-boundary and confused-deputy classes, the concrete payload is domain-specific to whatever interpreter or action surface the agent exposes (e.g., a shell, a build step, a code-generation-and-apply loop, or a repository operation). The specific primitive for CVE-2026-90999 is not disclosed; the exploitable property is that untrusted event-derived content reaches an execution sink with insufficient validation.

4) Post-exploitation impact. Because the payload executes as code inside a privileged automation environment, the impact inherits whatever authority that agent holds. Typical consequences for an agent-driven pipeline include unauthorized code modification or injection into the victim's repository, access to secrets or tokens available to the agent, lateral movement into connected CI/CD or deployment systems, and persistence via committed changes or pipeline configuration. The blast radius is bounded by the agent's privileges and reach — not by the attacker's initial access, which is effectively anonymous.

Assessment caveat. No known in-the-wild exploitation has been reported, there is no CISA KEV listing, and no exploit code is public. The scenario above is a structured inference from the vulnerability class, not a reproduction of a confirmed exploit.

Impact Assessment

The impact is best understood through the trust-boundary and confidentiality/integrity lens, because NVD has published no CVSS vector or score (CVSS = N/A) and no CWE. The analyst-derived vector shown in METADATA is provided for prioritization only and must not be treated as an official rating.

• Scope (S:C): The vulnerable component (Sentry Seer ingestion/agent pipeline) is not the component that suffers the ultimate impact (the privileged automation environment where code executes). This crosses a security scope boundary, which raises the effective severity.
• Confidentiality (C:H, derived): The agent operates in a privileged environment likely holding tokens, secrets, and repository access; code execution there can exfiltrate those assets.
• Integrity (I:H, derived): Execution in a privileged pipeline enables tampering with source code, artifacts, or deployment configuration.
• Availability (A:H, derived): A compromised automation agent can disrupt or subvert builds, releases, and issue-triage workflows.
• Attack vector / privileges (AV:N, PR:N): Remotely reachable and unauthenticated — the attacker needs neither account credentials nor infrastructure foothold.

Who is affected: Organizations running Sentry Seer with an agent that executes or applies actions in a privileged environment and that ingests externally-submittable telemetry. Because no affected version range is published, all deployments meeting that architectural condition must be treated as potentially affected until the vendor specifies otherwise.

Blast radius: Potentially very large and asymmetric — a single anonymous attacker can reach a privileged execution context that normally requires organizational trust. This is the defining risk of the confused-deputy / trust-boundary class.

Detection Guidance

Detection here is necessarily behavioral and architectural, because no payload signatures, endpoints, or IOCs are published. The following rules focus on the observable transition from external telemetry ingest to agent execution, which is the invariant of this vulnerability class. Analysts must tune field names and event sources to their own telemetry schema.

Sigma Rule

title: Suspicious Sentry Seer Agent Execution Following External Event Ingest
id: 7f3c1a92-5b4e-4d18-9c2a-90999a1b2c3d
status: experimental
description: Detects agent-initiated process or command execution in a privileged automation environment shortly after ingestion of externally-originated Sentry events, consistent with a trust-boundary violation (CVE-2026-90999).
author: valtersit.com
date: 2026-01-01
logsource:
  product: sentry
  service: seer
detection:
  selection_ingest:
    event.action: 'event_ingested'
    sentry.origin: 'external'
  selection_agent_exec:
    process.parent.name|contains: 'agent'
    process.command_line|contains:
      - 'seer'
      - 'sentry'
  timeframe: 5m
  condition: selection_ingest and selection_agent_exec
falsepositives:
  - Legitimate automated remediation triggered by genuine external error events
level: high
tags:
  - attack.t1190
  - cve.2026.90999

Note: Field names above are placeholders that must be mapped to the deployment's actual log schema; they are not asserted to exist in Sentry Seer.

YARA Rule

rule CVE_2026_90999_Sentry_Seer_TrustBoundary
{
    meta:
        description = "Detects telemetry payloads that attempt to cross the trust boundary into agent execution (CVE-2026-90999). Class-level heuristic; no published payload exists."
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90999"
        confidence = "low"

    strings:
        $seer  = "seer" nocase
        $agent = "agent" nocase
        $exec1 = "exec(" nocase
        $exec2 = "subprocess" nocase
        $exec3 = "system(" nocase
        $exec4 = "/bin/sh" nocase
        $exec5 = "cmd.exe" nocase

    condition:
        uint16(0) == 0x7b and          // JSON object start, common for event payloads
        any of ($exec*) and
        any of ($seer, $agent)
}

Note: This is a class-level heuristic. It will produce false positives on legitimate events that reference agent execution and will not match any specific undisclosed payload syntax.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-90999 Suspicious Sentry Event Ingestion with Execution Indicators"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"sentry"; http.request_body; content:"seer"; http.request_body; pcre:"/(exec\(|subprocess|system\(|\/bin\/sh|cmd\.exe)/i"; classtype:attempted-admin; sid:9099901; rev:1; reference:cve,2026-90999; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Note: URI content matching is generic to Sentry ingestion paths; adjust http.uri content to match the deployment's actual ingest path. No specific endpoint is asserted.

Elastic Detection

sequence by host.name with maxspan=5m
  [any where event.action == "event_ingested" and sentry.origin == "external"]
  [process where process.parent.name : "agent*" and
     (process.command_line : "*seer*" or process.command_line : "*sentry*")]

Note: Event and field names must be mapped to the environment's ECS/Sentry integration. This detects the temporal coupling of external ingest and agent execution.

Splunk SPL Query

index=sentry OR index=seer sourcetype=sentry:seer OR sourcetype=agent
| eval stage=case(
    match(_raw,"event_ingested|external.*telemetry"),"ingest",
    match(_raw,"(?i)(exec\(|subprocess|system\(|/bin/sh|cmd\.exe)") AND match(_raw,"(?i)agent"),"agent_exec",
    true(),"other")
| where stage!="other"
| stats count values(stage) as stages by host, user
| where mvcount(stages) > 1
| table host user stages count

Note: This correlates external ingest with agent execution on the same host within the search window. Field and sourcetype names must be adapted to the deployment.

Wazuh OSSEC Rule

<group name="sentry,seer,cve-2026-90999,">
  <rule id="909991" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">event_ingested</field>
    <field name="sentry.origin">external</field>
    <description>CVE-2026-90999: External Sentry event ingested - monitor for downstream agent execution</description>
  </rule>

  <rule id="909992" level="14">
    <if_sid>909991</if_sid>
    <field name="process.parent.name">agent</field>
    <match>exec\|subprocess\|system\(|/bin/sh|cmd\.exe</match>
    <description>CVE-2026-90999: Agent executed content following external Sentry ingest (possible trust-boundary violation)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Note: Decoder and field names are illustrative and must be aligned to the Wazuh JSON decoder for the deployment's Sentry/agent logs.

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No vendor fix, fixed version, or workaround has been published by any tracked source. There is no vendor advisory, no OSV package entry, and no affected-version confirmation to act on.

1) Immediate mitigations (compensating controls).

• Restrict the ingest boundary. Place the Sentry Seer ingestion surface behind authentication and network allow-listing where architecturally possible, and disable acceptance of events from sources that cannot be authenticated. This directly attacks the "unauthenticated" precondition.
• Enforce trust separation upstream of the agent. Treat all externally-originated telemetry as untrusted: route it through a validation/sanitization stage that strips or neutralizes any content capable of being interpreted as instructions or code before it reaches the agent.
• Reduce agent privilege (least privilege / no privileged execution). Do not run the Seer agent with the ability to execute arbitrary code, modify repositories, or reach secrets. Where the agent must act, require explicit human approval and use short-lived, scoped credentials.
• Kill the confused-deputy path. Ensure the agent only acts on internally-generated, cryptographically-attested instructions — never on raw event content.
• Monitor and alert using the detection rules above, focusing on the ingest→execution transition.

2) Patch / upgrade steps.

• There is no patch to apply at this time. Track the upstream Sentry Seer release notes and the CVE record for the first fixed version once published.
• Because no affected version range is available, do not assume any current version is unaffected. Inventory all Sentry Seer deployments and classify them by whether the agent has privileged execution reach.
• When a vendor advisory appears, prioritize deployments where the agent executes in privileged environments, and apply the fix before re-enabling external telemetry ingest.

3) Long-term hardening.

• Adopt a strict trust-boundary architecture for AI/agent pipelines: untrusted input must never reach an execution sink without an explicit, validated transformation step.
• Apply prompt-injection / instruction-injection defenses to agentic systems as a first-class control, not an afterthought.
• Enforce scoped credentials for every agent, with short lifetimes and fine-grained permissions, so that code execution in the agent environment has bounded blast radius.
• Add signed/attested instruction sources so the agent can cryptographically distinguish trusted internal actions from external telemetry.
• Include agent execution environments in threat modeling and CI/CD change audits, and continuously monitor for unexpected commits or pipeline changes originating from automation.

References

1. NVD — CVE-2026-90999 (authoritative record; currently no CVSS, CWE, or references): https://nvd.nist.gov/vuln/detail/CVE-2026-90999
2. CWE-501 — Trust Boundary Violation (vulnerability class reference): https://cwe.mitre.org/data/definitions/501.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Sentry Seer product documentation / release notes (monitor for the first fixed version and official advisory): https://sentry.io/
5. CISA Known Exploited Vulnerabilities Catalog — CVE-2026-90999 is not listed as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No known exploitation, no public PoC, no Nuclei template, and no threat-actor campaign associated with CVE-2026-90999 as of this writing. No EPSS score has been published by FIRST.org. This assessment reflects unavailable or non-public data and should be revisited as soon as the vendor publishes an advisory or the CVE record is enriched.