CVE-2026-90999Disclosure

LOWCVSS 9.8 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Sentry Seer is vulnerable to a multi-stage trust-boundary violation that allows unauthenticated attacker-controlled telemetry to become code that is executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without having access to the victim’s Sentry account, source repository, or infrastructure.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-20CWE-74CWE-94CWE-116CWE-913

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
11 mentions across 6 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 5 signals
Technical details provided in 10 signals
Disclosure: 6 classified signals
Peaked 5d ago at 4 mentions (2026-09-17); latest day: 1
11 total mentions across 6 days

Deep dive

Activity timeline11 mentions / 6d

Signal classification3 categories

Disclosure

654.5%

Patch

436.4%

PoC

19.1%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-17	4	Disclosure2Patch1PoC1
2026-09-18	1	Disclosure1
2026-09-19	2	Disclosure1Patch1
2026-09-20	2	Disclosure1Patch1
2026-09-21	1	Disclosure1
2026-09-26	1	Patch1

Full discourse11 posts

Nicolas Krassas@Dinosn45d
Disclosure
CVE-2026-90999: A fabricated Sentry bug report can make Seer's coding agent run attacker code https://agyn.io/blog/sentry-seer-autofix-vulnerability
Post summary
The text discloses CVE-2026-90999, explaining that a crafted Sentry bug report can trick Seer's coding agent into executing attacker code, with a link to a blog post for further details. No exploit tool, PoC, patch, or active exploitation evidence is provided in the text.
14022124.9K
162.6K followersView on X
Kyohei - OSS, 外資IT@labelmake45d
PoC
Sentryの自動修復機能を利用したファントムフィックス 2週間前はPOCだったのにCVEになっている😇 あらゆるイベントや入力を偽造して悪用できるからねぇ https://nvd.nist.gov/vuln/detail/cve-2026-90999
Post summary
The tweet notes that a issue previously only a PoC has now been assigned a CVE, explains it can be exploited by forging events or inputs, and mentions a phantom fix using Sentry's auto-repair function.
0001184.4K
9.1K followersView on X
/r/netsec@_r_netsec45d
Disclosure
CVE-2026-90999: A fabricated Sentry bug report can make Seer's coding agent run attacker code https://agyn.io/blog/sentry-seer-autofix-vulnerability
Post summary
The text announces CVE-2026-90999 and describes a vulnerability where a fabricated Sentry bug report can cause Seer's coding agent to execute attacker code. It lacks evidence of PoC, exploit tooling, active exploitation, or remediation details.
010331.1K
34.3K followersView on X
Mahdi@mahdi36d
Patch
Someone can invent a bug report through a public Sentry DSN and steer the autofix agent into running their code (CVE-2026-90999). Pause auto handoff until there’s a fix. https://www.kb.cert.org/vuls/id/212479
Post summary
The text discloses CVE-2026-90999 via a CERT/CC vulnerability note, describing code injection through a public Sentry DSN autofix agent, and recommends pausing auto handoff as a workaround pending a fix.
01040948
28.2K followersView on X
Hazem Omier@hazemomier43d
Disclosure
Sentry Seer “PhantomFix” (CVE-2026-90999, CVSS 9.8, CERT/CC Sep 16): public browser DSN → fabricated error events → Seer’s root-cause analysis → prompt handed to your coding agent (Claude / Cursor Cloud / Copilot Cloud) → attacker-chosen package install. No account. No repo access. Ten events can trip Autofix. Sentry status: Unknown; no fix published as of the note. This is Agentjacking with the platform AI doing the planting. If Autofix can open PRs or install packages, what’s your call: A) Stop after Root Cause / disconnect coding-agent handoff until patched B) Keep Autofix, but hard allow-list installs + human gate on every PR
Post summary
The text announces CVE-2026-90999 (CVSS 9.8), detailing a browser DSN fabrication chain that leads to attacker-chosen package installs via coding agents, and explicitly states no fix has been published as of the note.
20020148
493 followersView on X
Victor@VMG_CU41d
Disclosure
Telemetry isn't a trusted prompt. PhantomFix (CVE-2026-90999): fabricated error hits your public Sentry DSN, Seer hands it to a coding agent, agent installs attacker packages before any PR review. No patch yet. https://www.kb.cert.org/vuls/id/212479
Post summary
The text discloses a new vulnerability (CVE-2026-90999) in PhantomFix that allows an attacker to craft an error reaching a public Sentry DSN, causing a coding agent to install malicious packages before PR review, and notes that no patch is currently available.
0001057
16 followersView on X
E@ethanxpy45d
Patch
Sentry Seer: public DSN can become coding-agent RCE. CVE-2026-90999. Fake crash at the public DSN. Seer stuffs it into the autofix prompt. Agent pulls a package and runs it before anyone reviews a PR. CERT: kill auto handoff. No mass exploit yet — trust boundary is the story.
Post summary
The announcement details an RCE vulnerability (CVE-2026-90999) in Sentry Seer and recommends disabling auto handoff as an immediate workaround.
1000067
159 followersView on X
提灯人@FOMOMO26303943d
Patch
【投产前验收】遥测驱动 Agent 自动修？事实 CERT VU#212479 / CVE-2026-90999：公开 DSN 假事件→Seer 分析嵌进 Agent 提示→工具调用装攻击包；无补丁。 1. 关 Seer→Agent 自动 handoff 2. 装包/写删：人机确认，超时 fail-closed 3. 最小权限+沙箱隔离 4. 审计日志可回滚 https://t.co/K8NgoMBsSY
Post summary
The text discusses CVE-2026-90999, noting no patch is available but providing specific workarounds like disabling automatic handoffs and implementing confirmations to mitigate the risk.
0000052
20 followersView on X
SecAlerts@SecAlertsCo44d
Disclosure
🤖 Sentry Seer (CVSS 9.8): unauthenticated telemetry input can cross trust boundaries and execute as code inside a privileged automation agent. CVE-2026-90999 is a nasty injection chain. #cybersecurity #ciso #cto #vulnerabilities #mssp https://secalerts.co/vulnerability/CVE-2026-90999?utm_campaign=x https://t.co/rP7QNiMYjj
Post summary
The tweet announces CVE-2026-90999 as a high-severity injection-chain vulnerability in Sentry Seer (CVSS 9.8) enabling unauthenticated code execution in a privileged agent, but includes no PoC, exploit tool, patch, or active-exploitation evidence.
00000161
889 followersView on X
Venkata Satish Guttula 🛰️@snakeyesV144d
Patch
News: Sentry Seer CVE-2026-90999 turns attacker-crafted public DSN errors into coding-agent prompts that install attacker packages. Hits orgs with Seer auto-remediation on. Disable Seer handoff and agent package installs until a patch ships. https://www.kb.cert.org/vuls/id/212479
Post summary
The tweet reports CVE-2026-90999, describing how DSN errors trigger code‑agent prompts to install malicious packages, and urges disabling Seer handoff and package installs pending a patch.
0000081
3.0K followersView on X
Ryan Merck@rmerck45d
Disclosure
I have watched teams wire Seer straight into a coding agent and call it velocity. CERT/CC says a public DSN plus auto handoff can become privileged code execution before anyone reviews a PR (CVE-2026-90999). That pipeline was never a security boundary. https://www.kb.cert.org/vuls/id/212479
Post summary
The text announces CVE-2026-90999, disclosing that CERT/CC identified a vulnerability where a public DSN with automated handoff in a coding agent pipeline can lead to privileged code execution before PR review. Technical details are provided, but no PoC, exploit tool, active exploitation claim, or named remediation is included in the text itself.
0000049
46 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-90999

Nicolas Krassas[verified]@DinosnDisclosure

The text discloses CVE-2026-90999, explaining that a crafted Sentry bug report can trick Seer's coding agent into executing attacker code, with a link to a blog post for further details. No exploit tool, PoC, patch, or active exploitation evidence is provided in the text.

Kyohei - OSS, 外資IT[verified]@labelmakePoC

The tweet notes that a issue previously only a PoC has now been assigned a CVE, explains it can be exploited by forging events or inputs, and mentions a phantom fix using Sentry's auto-repair function.

Mahdi[verified]@mahdiPatch

The text discloses CVE-2026-90999 via a CERT/CC vulnerability note, describing code injection through a public Sentry DSN autofix agent, and recommends pausing auto handoff as a workaround pending a fix.

Hazem Omier[verified]@hazemomierDisclosure

The text announces CVE-2026-90999 (CVSS 9.8), detailing a browser DSN fabrication chain that leads to attacker-chosen package installs via coding agents, and explicitly states no fix has been published as of the note.

E[verified]@ethanxpyPatch

The announcement details an RCE vulnerability (CVE-2026-90999) in Sentry Seer and recommends disabling auto handoff as an immediate workaround.

Venkata Satish Guttula 🛰️[verified]@snakeyesV1Patch

The tweet reports CVE-2026-90999, describing how DSN errors trigger code‑agent prompts to install malicious packages, and urges disabling Seer handoff and package installs pending a patch.

Ryan Merck[verified]@rmerckDisclosure

The text announces CVE-2026-90999, disclosing that CERT/CC identified a vulnerability where a public DSN with automated handoff in a coding agent pipeline can lead to privileged code execution before PR review. Technical details are provided, but no PoC, exploit tool, active exploitation claim, or named remediation is included in the text itself.

/r/netsec@_r_netsecDisclosure

The text announces CVE-2026-90999 and describes a vulnerability where a fabricated Sentry bug report can cause Seer's coding agent to execute attacker code. It lacks evidence of PoC, exploit tooling, active exploitation, or remediation details.