CVE-2026-62676: Omnigent Framework Auth Bypass Vulnerability

CVE-2026-62676 Overview

CVE-2026-62676 is an allowlist bypass in Omnigent, an open-source AI agent framework and meta-harness for orchestrating coding agents. The shared shell-command parser in omnigent/policies/builtins/_shell.py fails to recognize combined interpreter flags, the timeout, nice, setsid, and stdbuf wrappers, command substitutions, and a single background control operator. When a gated git push or gh write command is hidden inside these forms, the parser returns no parsed operation. As a result, the github.pywrite_repos and write_branches allowlists and the working_dir.py workspace confinement policies abstain and allow the command. The issue is fixed in version 0.3.0.

Critical Impact
An authenticated or prompt-injected agent can push code to unauthorized repositories or branches and escape the intended workspace, undermining the entire policy-based sandbox.

Affected Products

Omnigent AI agent framework versions prior to 0.3.0
Deployments relying on omnigent/policies/builtins/_shell.py for command parsing
Environments enforcing github.py write allowlists or working_dir.py workspace confinement

Discovery Timeline

2026-08-21 - CVE-2026-62676 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-62676

Vulnerability Analysis

Omnigent uses a shared shell-command parser to identify which operation an agent is attempting before applying policy checks. Policies such as write_repos, write_branches, and workspace confinement depend on the parser correctly identifying the underlying binary and arguments. The parser follows an incomplete restrictive list pattern classified as [CWE-184] (Incomplete List of Disallowed Inputs). When the parser cannot classify a command, downstream policies abstain rather than deny, converting parser gaps into policy bypasses.

An agent can smuggle a gated git push or gh write command through several forms the parser does not recognize. Combined single-letter interpreter flags, wrapper binaries like timeout, nice, setsid, and stdbuf, shell command substitutions, and a single trailing background control operator all produce empty parse results. The policy engine then allows the command to execute unchecked.

Root Cause

The parser in _shell.py normalizes only a narrow subset of shell syntax. It does not decompose wrapper invocations, does not split combined short flags on interpreters, and does not recurse into command substitutions. Because the surrounding policy code treats an unparsed command as out of scope rather than untrusted, the abstain-on-unknown behavior becomes the exploitation primitive.

Attack Vector

An authenticated user of the agent harness, or an external attacker who lands a prompt injection in agent-consumed content, submits a task that instructs the agent to run a wrapped or substituted form of git push or a gh write subcommand. The github.py allowlist never sees a recognizable operation, so the push proceeds to an unauthorized repository or branch. The same technique lets an agent invoke commands outside the confined working directory enforced by working_dir.py. See the GitHub Security Advisory GHSA-7mqg-cx4g-x2rf and the fix commit for the specific evasion forms.

// Example exploitation code (sanitized)
No verified proof-of-concept code is published. Refer to the advisory and
pull request for the evasion classes: wrapper binaries (timeout/nice/setsid/stdbuf),
combined interpreter flags, command substitutions, and a trailing background operator.

Detection Methods for CVE-2026-62676

Indicators of Compromise

Unexpected git push events to repositories or branches not present in the configured write_repos or write_branches allowlists.
Agent shell invocations wrapping git or gh with timeout, nice, setsid, or stdbuf, or containing $( ) or backtick substitutions.
Process trees showing agent-spawned commands operating on paths outside the declared workspace root.

Detection Strategies

Log the full argv of every command executed by the Omnigent runtime and alert on wrapper binaries preceding git or gh.
Correlate Git server audit logs with the agent's declared allowlist to detect pushes that policy should have blocked.
Inspect agent transcripts for prompt-injection patterns that request wrapped or backgrounded shell execution.

Monitoring Recommendations

Enable verbose policy-decision logging in Omnigent and treat abstain outcomes on shell operations as high-severity events until upgraded.
Monitor repository webhooks and branch protection audit trails for pushes originating from agent service accounts.
Track file writes outside the intended workspace directory using host telemetry on the machines running the agent.

How to Mitigate CVE-2026-62676

Immediate Actions Required

Upgrade Omnigent to version 0.3.0 or later, which corrects the parser and closes the abstain-to-allow gap.
Rotate any Git or GitHub credentials, tokens, or SSH keys the agent had access to while running vulnerable versions.
Audit repositories and branches reachable by agent credentials for unauthorized commits pushed during the exposure window.

Patch Information

The fix is included in Omnigent v0.3.0. The parser changes are described in the pull request discussion and applied in commit 1a05b7b. Upgrading is the only complete remediation.

Workarounds

Restrict the agent's Git and GitHub tokens to the minimum set of repositories and branches, using server-side branch protection as a defense in depth.
Run the agent under an OS user whose filesystem access is limited to the intended workspace, so a parser bypass cannot reach sensitive paths.
Block the timeout, nice, setsid, and stdbuf binaries from the agent's execution environment if they are not required for legitimate tasks.

bash

# Configuration example
pip install --upgrade 'omnigent>=0.3.0'