Sentry Seer is vulnerable to a multi-stage trust-boundary violation

CVE-2026-90999 is a multi-stage trust-boundary violation in Sentry's Seer AI debugging assistant. When Seer is configured to hand issues to an integrated coding agent (Claude Code, Cursor, Codex, or similar), an external attacker who knows — or finds — a project's public DSN can POST a fabricated error event containing malicious instructions disguised as a resolution. Seer ingests the event, generates a root-cause analysis that embeds attacker-controlled fields, and passes it as a structured prompt to the coding agent. The agent then downloads and executes attacker-controlled packages (e.g., a malicious npx payload) with the developer's full privileges, exfiltrating credentials, AWS keys, GitHub tokens, and SSH keys. All Sentry organizations that have Seer enabled with coding-agent handoff and a publicly exposed DSN are affected. No specific version range has been published by the vendor; the vulnerability is architectural and tied to the Seer→agent pipeline.

There is no vendor CVSS score for this CVE. CERT/CC published VU#212479 on 2026-09-16 without a score, and NVD analysis is pending. Related "agentjacking" research by Tenet Security (disclosed to Sentry on 2026-06-03) demonstrated an 85% exploitation success rate across Claude Code, Cursor, and Codex in controlled tests. The attack is unauthenticated and remote, which would normally push toward CRITICAL. However, the chain requires an opt-in feature (Seer + coding agent integration) that is still in early-adopter rollout, meaningfully narrowing the reachable population. noisgate assesses this at HIGH (8.1) — the supply-chain blast radius is severe for affected orgs, but the installed base gating prevents a CRITICAL floor.

Why this verdict

• Unauthenticated remote attack: The DSN is a public credential by design, and the Sentry ingest endpoint requires no authentication. The attacker needs zero prior access to the victim's Sentry account, source code, or infrastructure. This is a true unauthenticated network attack.
• Supply-chain blast radius: Successful exploitation gives the attacker code execution in the developer's environment with access to source repositories, CI/CD credentials, AWS keys, and GitHub tokens. This is a supply-chain pivot — the attacker can inject backdoors into production code, compromise build pipelines, and laterally move across the organization's infrastructure.
• Role multiplier: The affected component (Sentry Seer + coding agent) occupies a CI/CD-adjacent role. When the coding agent runs in a CI/CD environment (e.g., GitHub Actions self-hosted runner, Cursor in a shared dev environment), the blast radius extends to supply-chain scale. However, Seer + coding agent integration is an opt-in early-adopter feature — the majority of Sentry's install base (~100K+ organizations) does not have this enabled. The high-value role population is estimated at <5% of Sentry users, which means the floor is HIGH but not CRITICAL.
• 85% exploitation success rate: Tenet's controlled testing demonstrated reliable exploitation across Claude Code, Cursor, and Codex. The attack is not theoretical — it works consistently when the prerequisite configuration exists.
• No patch available: As of 2026-09-18, Sentry has not published a fix. The vulnerability is architectural (trust boundary between telemetry ingest and agent execution), suggesting a non-trivial remediation effort.

Why not higher?

CRITICAL would require either active KEV listing or a canonical high-value-role component where ≥10% of installs occupy the high-value role by definition. Sentry Seer with coding agent handoff is an opt-in early-adopter feature — the vast majority of Sentry's install base is not configured for automated agent remediation. The attack also has an AC:H component: the event must pass Seer's internal confidence heuristics to trigger agent handoff, adding non-trivial friction. The 2,388 exposed DSNs represent DSN exposure, not agent-enabled configurations.

Why not lower?

MEDIUM would undercount the blast radius for affected organizations. The attack is unauthenticated, remote, and reliably exploitable (85% success rate). Successful exploitation yields supply-chain-scale impact: source repo write access, credential theft, and CI/CD pipeline compromise. The attack methodology is publicly documented and trivially reproducible with a single curl command. For any organization that has Seer + agent enabled, this is effectively a CRITICAL-severity issue.

1. Disable Seer → coding agent handoff immediately — The most effective mitigation is severing the trust chain between Sentry telemetry and code execution. Disable the Autofix-to-agent pipeline in Sentry project settings. This eliminates the attack surface entirely while preserving Seer's read-only analysis capabilities. Deploy within 72 hours given zero-patch status (noisgate HIGH mitigation SLA: 30 days, but urgency warranted).
2. Require human approval for all agent shell commands — Configure coding agents (Cursor, Claude Code) to require explicit human confirmation before executing any shell command, npx invocation, or package installation. This breaks the automated execution chain at step 4. Deploy within 30 days per the noisgate HIGH mitigation SLA.
3. Audit and rotate exposed DSNs — Search your JavaScript bundles, public repositories, and CI/CD configs for exposed Sentry DSNs. Rotate any DSN found in public-facing code. Consider proxying client-side telemetry through a server-side relay to prevent future DSN exposure. Deploy within 30 days.
4. Sandbox agent execution environments — If coding agents must remain active, run them in isolated sandboxes with no access to production credentials, restricted network egress, and read-only repository access. Use Codex's sandboxed mode or equivalent isolation. Deploy within 30 days.
5. Deploy agent-jackstop hardening configs — Tenet Security open-sourced drop-in configurations that harden Cursor and Claude Code against untrusted telemetry injection. These filter Sentry MCP output before it reaches the agent's execution context. Deploy within 30 days.

Run on any workstation with curl and access to your Sentry organization. Requires a valid Sentry API auth token with org:read and project:read scopes. Invoke with: bash check_cve_2026_90999.sh <SENTRY_ORG_SLUG> <SENTRY_AUTH_TOKEN>. Checks whether any projects have Seer autofix and coding agent integrations enabled.

#!/usr/bin/env bash
# check_cve_2026_90999.sh — Detect exposure to CVE-2026-90999
# Checks Sentry org for Seer + coding agent configuration
# Exit codes: 1=VULNERABLE, 0=PATCHED/NOT_AFFECTED, 2=UNKNOWN

set -euo pipefail

ORG="${1:-}"
TOKEN="${2:-}"

if [[ -z "$ORG" || -z "$TOKEN" ]]; then
  echo "Usage: $0 <ORG_SLUG> <AUTH_TOKEN>"
  exit 2
fi

BASE="https://sentry.io/api/0"
VULN=0

echo "[*] Checking organization features for Seer/Autofix..."
ORG_RESP=$(curl -sf -H "Authorization: Bearer $TOKEN" "$BASE/organizations/$ORG/" 2>/dev/null) || {
  echo "UNKNOWN — could not query Sentry API. Verify org slug and token."
  exit 2
}

echo "[*] Checking for coding agent integrations..."
INTEGRATIONS=$(curl -sf -H "Authorization: Bearer $TOKEN" "$BASE/organizations/$ORG/integrations/" 2>/dev/null) || {
  echo "UNKNOWN — could not query integrations endpoint."
  exit 2
}

HAS_SEER=$(echo "$ORG_RESP" | grep -ci 'seer\|autofix\|ai-autofix' || true)
HAS_AGENT=$(echo "$INTEGRATIONS" | grep -ci 'cursor\|claude-code\|codex\|coding-agent' || true)

if [[ $HAS_SEER -gt 0 && $HAS_AGENT -gt 0 ]]; then
  echo "VULNERABLE — Seer features detected AND coding agent integration found."
  echo "Action: Disable Seer->agent handoff immediately per CVE-2026-90999."
  VULN=1
elif [[ $HAS_SEER -gt 0 ]]; then
  echo "VULNERABLE — Seer features detected. Verify agent config manually."
  VULN=1
else
  echo "PATCHED — No Seer/Autofix features or coding agent integrations detected."
fi

echo ""
echo "[*] DSN exposure check (manual step recommended):"
echo "    grep -r 'sentry.io' --include='*.js' --include='*.ts' your-frontend/"
echo "    GitHub: https://github.com/search?q=org:<your-org>+sentry+dsn"

exit $((VULN > 0 ? 1 : 0))

Sources

1. CERT/CC Vulnerability Note VU#212479
2. Tenet Security — Agentjacking: Coding Agents with Fake Sentry Errors
3. CSA Research Note — Agentjacking via Sentry MCP Injection
4. OpenCVE — CVE-2026-90999 Details
5. Sentry Documentation — Coding Agents Integration
6. Sentry Documentation — Seer Autofix
7. SaaSRise — Sentry DSN Vulnerability Threatens AI Coding Agents
8. DevOps.com — Tenet Agentjacking Attack