Critical Progress DataDirect GenAI Flaw Lets Malicious OpenAPI Files Execute OS Commands

Progress Software has disclosed a critical command injection vulnerability , tracked as CVE-2026-91140, in the Early Access Release of its DataDirect Autonomous REST Connector (ARC) AI Model Generator agents. A specially crafted OpenAPI/Swagger document can make an affected agent run arbitrary operating system commands. Progress has released fixed agent definitions. Progress DataDirect GenAI flaw According to the advisory published by Progress Software , the flaw affects…