Executive brief
Sentry Seer is an automated debugging assistant that integrates with Sentry's error-monitoring platform to analyze telemetry and propose code fixes through a connected coding agent. The vulnerability allows an external attacker to submit fabricated error events through Sentry's public endpoint without authentication, which are then processed as legitimate issues and passed to the automated coding agent. The agent executes attacker-controlled code packages within a privileged environment that has access to source repositories, enabling arbitrary code execution and potential compromise of the victim's codebase.
Technical details
This vulnerability is a multi-stage trust-boundary violation in Sentry Seer's analysis and remediation pipeline. The root cause is the failure to sanitize attacker-controlled telemetry fields (exception messages, stack traces, source context, breadcrumbs) before embedding them into the prompt delivered to an automated coding agent. An unauthenticated attacker can submit malicious events through Sentry's publicly-exposed DSN (Data Source Name) endpoint. When automated remediation is enabled, Seer processes these fabricated events, generates a root-cause analysis incorporating untrusted input, and passes this analysis to the coding agent. The agent treats the attacker's crafted analysis as legitimate, downloads and executes attacker-specified packages, all within a privileged automation environment prior to human review. No vendor patch is currently available.
Affected products
- Sentry Sentry <UNKNOWN>
Timeline
- 2026-09-16: disclosed
- 2026-09-16: advisory