CVE-2026-62674: Omnigent AI Framework RCE Vulnerability

CVE-2026-62674 Overview

CVE-2026-62674 is a code injection vulnerability in Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents. The flaw exists in the PUT /sessions/{session_id}/agent endpoint, which enforces LEVEL_EDIT permission for the target session but fails to reject bound shared or template agents whose agent.session_id is None. An authenticated user with session edit access can overwrite a shared agent bundle and inject a malicious stdio Model Context Protocol (MCP) server. Subsequent sessions using the shared agent execute the attacker-controlled command with the Omnigent runner process privileges. The issue is tracked as [CWE-94] and fixed in version 0.3.0.

Critical Impact
An authenticated user can pivot from single-session edit access to remote code execution against every user of the shared agent, exposing files, credentials, workspace data, and internal services.

Affected Products

Omnigent versions prior to 0.3.0
omnigent/server/routes/sessions.py shared-agent update path
omnigent/tools/mcp.py stdio MCP server launcher

Discovery Timeline

2026-08-21 - CVE-2026-62674 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-62674

Vulnerability Analysis

Omnigent supports two classes of agents. Session-bound agents carry a populated agent.session_id, while shared and template agents carry agent.session_id = None and are intended to be read-only through user-facing endpoints. The PUT /sessions/{session_id}/agent route accepts a bundle upload to replace the agent bound to a session. The route validates that the caller holds LEVEL_EDIT on the session but does not check the class of the currently bound agent. When a shared or template agent is bound to that session, the upload replaces the shared bundle globally rather than producing a session-scoped copy.

The replacement bundle can declare arbitrary MCP servers, including stdio transports that launch local commands. When a different user later opens a session backed by the same shared agent, omnigent/tools/mcp.py spawns the attacker-supplied executable under the Omnigent runner process. This yields arbitrary command execution on the runner host.

Root Cause

The missing guard is an authorization check on the object being modified. The route treated LEVEL_EDIT on a session as sufficient authority to mutate any agent bound to that session. Shared and template agents are cross-session objects, so session-level permission does not translate to authority over them.

Attack Vector

The attack requires a network-reachable Omnigent server, an authenticated account, and edit access to at least one session that uses a shared agent. The attacker crafts a bundle containing a malicious stdio MCP server definition, uploads it through the vulnerable endpoint, and waits for another user to invoke the shared agent. Exploitation requires user interaction from the victim, who must launch a session that loads the poisoned shared agent.

python

                 code=ErrorCode.NOT_FOUND,
             )
 
+        # Shared/template agents are read-only here;
+        # mirrors the guard in session_mcp_servers._editable_agent.
+        if agent.session_id is None:
+            raise OmnigentError(
+                "Built-in agents are read-only through this endpoint.",
+                code=ErrorCode.INVALID_INPUT,
+            )
+
         bundle_bytes = await bundle.read()
         # Run bundle validation (tar extraction + spec parse, both
         # blocking) off the event loop -- mirrors the POST
# Source: https://github.com/omnigent-ai/omnigent/commit/25a22dc9e6da4648d23749f0a589e47e6aed991b

The patch rejects any bundle upload targeting an agent whose session_id is None, matching the read-only guard already present in session_mcp_servers._editable_agent.

Detection Methods for CVE-2026-62674

Indicators of Compromise

HTTP PUT requests to /sessions/{session_id}/agent followed by shared-agent changes visible to other tenants or users.
Unexpected stdio MCP server entries in shared or template agent specifications, especially commands referencing shells, interpreters, or network utilities.
New child processes of the Omnigent runner that do not match the deployment's baseline MCP tool inventory.

Detection Strategies

Audit shared agent bundles by comparing MCP server definitions against a known-good manifest and flagging any drift.
Enable request logging on the Omnigent API and correlate PUT /sessions/{session_id}/agent calls with the target agent's session_id field.
Monitor process trees on runner hosts for executions spawned by the Omnigent process that fall outside the approved MCP tool list.

Monitoring Recommendations

Alert on outbound network connections initiated by MCP child processes to non-approved destinations.
Track file access by the Omnigent runner to credential stores, .env files, and cloud metadata endpoints.
Review authentication logs for accounts issuing bundle uploads shortly before anomalous runner activity.

How to Mitigate CVE-2026-62674

Immediate Actions Required

Upgrade Omnigent to version 0.3.0 or later, which enforces the read-only guard on shared and template agents.
Inventory all shared and template agents and validate their MCP server definitions against source control before re-enabling sessions.
Rotate credentials, tokens, and secrets accessible to the Omnigent runner if exploitation cannot be ruled out.

Patch Information

The fix is committed in GitHub Commit 25a22dc and released in Omnigent v0.3.0. See GHSA-jrrm-9hc7-2v3h and Pull Request #1418 for the advisory and code review.

Workarounds

Restrict LEVEL_EDIT permissions on sessions that reference shared or template agents until the patched release is deployed.
Run the Omnigent runner as an unprivileged user with a locked-down filesystem and network egress policy to limit command-execution blast radius.
Disable stdio MCP transports for shared agents where feasible, or pin allowed executables to a signed allowlist.

bash

# Upgrade Omnigent to the fixed release
pip install --upgrade "omnigent>=0.3.0"

# Verify installed version
python -c "import omnigent, sys; print(omnigent.__version__)"