VU#212479: Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
CERT/CC details CVE-2026-90999: attacker-controlled Sentry telemetry can steer the Seer coding agent into executing attacker code with repository access.
CERT/CC published VU#212479 for CVE-2026-90999 in Sentry Seer: attacker-submitted events through public DSN endpoints flow into Seer's root-cause analysis, which is embedded directly into the coding agent's initial prompt. In the documented chain, the privileged coding agent downloads and executes an attacker-controlled package before any human review, yielding arbitrary code execution with access to connected source repositories. No vendor patch is available yet; mitigations include disabling automated remediation, restricting coding-agent package installation, and filtering telemetry before Seer analysis.
- Attacker exception events submitted via public DSN propagate through Seer analysis into the coding agent's prompt.
- Coding agent downloads and executes an attacker-controlled package before human review of any pull request.
- Impact is arbitrary code execution in the coding-agent environment handling the victim's repository.
- No patch yet; mitigations include disabling Seer handoff and restricting package installation.
- Reported by Nikita Benkovich and Vitalii Valkov of agyn; published September 16, 2026.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-90999 | Unauthenticated Telemetry-to-Code Execution in Sentry Seer AI Agent Sentry Seer, Sentry's AI-powered debugging/fix agent, suffers from a multi-stage trust-boundary violation in which unauthenticated, attacker-controlled telemetry (Sentry events) is treated as trusted input and ultimately becomes code executed by the agent in a privileged automation environment. An external attacker triggers the flaw by submitting fabricated error events to a victim's Sentry organization without needing access to the victim's account, source repository, or infrastructure; when Seer processes the crafted events, the embedded content is translated into executed automation. Successful exploitation gives the attacker code execution within Seer's privileged environment, with whatever access that automation context carries. Any Sentry customer organization that has Seer enabled and accepts externally submitted event data is affected. As of this writing the flaw has no CVSS score, is not in CISA KEV, has no known public proof-of-concept, and there are no confirmed reports of in-the-wild exploitation (CERT/CC advisory VU#212479). Do: Track CERT/CC VU#212479 and Sentry's advisories for the patched release and apply it promptly, since Seer is a SaaS feature and remediation may arrive server-side or as a configuration change. Until patched, consider disabling Seer or excluding projects that receive unauthenticated SDK events (e.g., public-facing web/mobile apps) from automated analysis, and lock down event ingestion (DSN handling, allowlisted origins). Review Seer automation logs and any agent-executed actions for unexpected code execution or anomalous event sources. | — | — |
| large≈tens of thousands of organizations (Sentry publicly reports 100,000+ customer organizations/~4M developers; Seer is an opt-in AI feature, so affected… |
Full article424 words · extracted from kb.cert.org · click to collapse
Overview
A vulnerability exists in Sentry Seer when the system is configured to automatically hand issues to a coding agent for remediation. Successful exploitation results in arbitrary code execution within the coding‑agent environment and access to connected source repositories. This vulnerability is tracked as CVE-2026-90999.
Description
Sentry is a software error‑monitoring and performance‑tracking platform used by developers to detect, diagnose, and understand issues in their applications. It collects telemetry such as exceptions, stack traces, logs, and performance data from applications. Built into Sentry, Seer acts as an automated debugging assistant that converts telemetry into actionable remediation steps and can hand off issues to an integrated coding agent to propose code fixes.
Because Sentry front-end projects commonly expose a public DSN (Data Source Name) to allow browsers to submit this telemetry, an attacker can craft and submit malicious events through this public endpoint. When Seer is enabled to automatically pass issues to a coding agent, these attacker-supplied events can traverse multiple trust boundaries. Ultimately, malicious event fields propagate through Seer’s analysis pipeline, transforming into untrusted instructions that the privileged coding agent may execute.
The vulnerable workflow is as follows:
* Sentry ingests attacker‑generated exception events submitted through the public DSN.
* Seer evaluates whether the event represents an issue eligible for automated remediation.
* Seer generates a root‑cause analysis that uses attacker-controlled event fields, including exception messages, stack traces, source context, and breadcrumbs.
* The generated analysis is embedded directly into the initial prompt provided to the coding agent.
* The coding agent interprets the fabricated analysis as a legitimate description of the victim’s codebase.
* During its investigation, the coding agent downloads and executes a package controlled by the attacker.
* The package executes within the coding‑agent environment prior to any human review of a pull request.
Impact
Successful exploitation may allow arbitrary code execution in the coding‑agent environment that processes the affected repository.
Solution
At the time of this writing, no vendor‑supplied patch information has been provided. Mitigations may include disabling automated remediation flows, restricting coding‑agent package installation, or disabling Seer handoff until a fix is available. Additional defensive filtering of telemetry content before Seer analysis may also reduce risk.
Acknowledgements
Thank you to Nikita Benkovich and Vitalii Valkov, agyn for reporting this vulnerability. This document was written by Bob Kemerer.
Vendor Information
212479
Filter by status:
Filter by content: Additional information available
Sort by:
Other Information
| CVE IDs: | CVE-2026-90999 |
| API URL: | VINCE JSON | CSAF |
| Date Public: | 2026-09-16 |
| Date First Published: | 2026-09-16 |
| Date Last Updated: | 2026-09-16 15:18 UTC |
| Document Revision: | 1 |
Text extracted automatically; images, tables and formatting may be missing. Original: https://kb.cert.org/vuls/id/212479