HolmesGPT 0.40.0 is almost entirely a security release: command injection across five toolsets, SSRF, and signed bash approval prefixes

GitHub·high signalXBlueskyLinkedInCopy link

The CNCF Sandbox SRE agent (3,153 stars) shipped 0.40.0 on 2026-08-26 with fixes for command injection in the Kubernetes toolset (ROB-893) plus slab, kubevela, inspektor_gadget and aks follow-ups, SSRF in the internet/fetch_webpage and connectivity_check toolsets (ROB-896), and hardening of kubectl-run to execute without a host shell. The bash toolset now validates command arguments and redirections rather than just the prefix, and session-approval prefixes are cryptographically signed to prevent forgery. This is the clearest signal yet that agent toolsets that shell out are being treated as an attack surface with real CVE-class findings, not a theoretical one.