CVE-2026-45374: Rust Privilege Flag Unwrap Or Truecve-2026-45374-rust-privilege-flag-unwrap-or-true
Security capability flag $OPT is defaulted to `true` via `unwrap_or(true)`, so an omitted field (e.g. a model-supplied tool argument, API payload, or unset config key) silently grants the capability (shell execution, auto-approval, elevated trust) instead of requiring explicit opt-in. This fail-open default decouples what a requester/approver sees from the p
