CVE-2026-62675 Overview
CVE-2026-62675 is a code injection vulnerability in Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents. Versions prior to 0.3.0 accept authenticated agent bundles through a multipart POST /v1/sessions request without validating the tools..callable dotted Python path. An authenticated user can supply a bundle referencing arbitrary callables such as subprocess.check_output, which the runner then imports and executes with its own process permissions. This weakness is classified as CWE-94: Improper Control of Generation of Code. The maintainers fixed the issue in version 0.3.0.
Critical Impact
Authenticated attackers can execute arbitrary local commands as the Omnigent runner, exposing credentials, environment variables, workspace data, and internal services.
Affected Products
- Omnigent AI agent framework versions prior to 0.3.0
- Deployments exposing the POST /v1/sessions bundle upload endpoint
- Runner hosts executing untrusted or user-supplied agent bundles
Discovery Timeline
- 2026-08-21 - CVE-2026-62675 published to NVD
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-62675
Vulnerability Analysis
Omnigent orchestrates coding agents by loading user-supplied agent bundles that declare tools the runner can invoke. The POST /v1/sessions endpoint accepts a multipart bundle from any authenticated user. omnigent/server/bundles.py calls validate_agent_bundle to sanity-check the bundle, but the validation does not restrict which dotted Python path a tools..callable entry may reference. Any importable module and attribute on the runner host is therefore reachable.
During session execution, omnigent/runner/tool_dispatch.py invokes _resolve_spec_callable, which performs a dynamic import of the declared module and resolves the attribute. _execute_spec_callable_tool then calls the resolved function with attacker-controlled arguments. Selecting a callable such as subprocess.check_output turns the tool dispatch path into an arbitrary command execution primitive running under the runner's identity.
Root Cause
The root cause is missing allowlist enforcement on tool callable references. Bundle validation trusts caller-supplied dotted paths and does not constrain resolution to a vetted set of internal tool functions, violating the intent of CWE-94.
Attack Vector
An authenticated user uploads a crafted agent bundle whose tool specification points callable to a sensitive builtin or standard library function. When the runner dispatches the tool during session execution, it executes the attacker's chosen function with the arguments encoded in the bundle. See the GitHub Security Advisory GHSA-756x-9hf6-q4h4 for the maintainers' description of the flaw.
The vulnerability manifests in the bundle validation and tool dispatch flow. See the advisory and GitHub Pull Request #1430 for technical details of the fix.
Detection Methods for CVE-2026-62675
Indicators of Compromise
- Agent bundles containing tools..callable entries referencing modules outside the Omnigent tool namespace, especially subprocess, os, shutil, socket, or builtins.
- Unexpected child processes spawned by the Omnigent runner process, such as shells, network utilities, or credential-reading commands.
- Outbound network connections from the runner host to attacker-controlled infrastructure shortly after POST /v1/sessions requests.
Detection Strategies
- Inspect stored bundle manifests and reject or alert on callable fields whose dotted path does not resolve to an approved Omnigent tool module.
- Correlate POST /v1/sessions API events with process creation telemetry on the runner host to surface command executions that follow session creation.
- Monitor for reads of sensitive files (/etc/shadow, .env, cloud credential files, SSH keys) by the runner process user.
Monitoring Recommendations
- Enable process, file, and network telemetry on all hosts running the Omnigent runner and forward events to a central analytics platform.
- Track the installed Omnigent version across deployments and alert on any instance below 0.3.0.
- Audit authenticated users permitted to upload bundles and review their session activity for anomalous tool usage.
How to Mitigate CVE-2026-62675
Immediate Actions Required
- Upgrade Omnigent to version 0.3.0 or later on every server and runner host.
- Rotate any credentials, API tokens, and secrets that were accessible in the runner's environment or workspace.
- Revoke session tokens for users who uploaded bundles during the exposure window and review their bundle history.
Patch Information
The issue is fixed in Omnigent 0.3.0. Review the GitHub Commit, GitHub Pull Request #1430, and GitHub Release v0.3.0 for the applied changes.
Workarounds
- Restrict POST /v1/sessions to trusted operators through network controls or an authenticating reverse proxy until patching completes.
- Run the Omnigent runner as an unprivileged, sandboxed user with no access to host secrets, cloud metadata, or internal services.
- Apply egress network filtering on runner hosts to limit reachable destinations and reduce the value of any executed command.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
