CVE-2026-66065 Overview
CVE-2026-66065 affects Ouroboros, a local-first runtime for AI coding agents that records agent actions and enforces user-defined policies. Versions prior to 0.42.1 ship an incomplete environment variable denylist that fails to block several execution-routing keys of the same remote code execution class. A malicious cloned repository can bypass the approval gate by shipping a .env file, which Ouroboros auto-loads at import without any review step. The flaw represents an incomplete fix for CVE-2026-47211, which added _UNTRUSTED_ENV_DENYLIST but omitted backend, config-home, and MCP/plugin root variables. This issue is fixed in version 0.42.1.
Critical Impact
Attackers can achieve arbitrary command execution on a developer's workstation simply by having the user clone and open a malicious repository in Ouroboros.
Affected Products
- Ouroboros runtime for AI coding agents
- All versions prior to 0.42.1
- Deployments that auto-load project-directory .env files at import
Discovery Timeline
- 2026-08-03 - CVE-2026-66065 published to the National Vulnerability Database (NVD)
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-66065
Vulnerability Analysis
Ouroboros enforces user-defined policies to constrain what AI coding agents may do at runtime. The security model relies on an approval gate and a denylist of untrusted environment variables loaded from project-directory .env files. CVE-2026-47211 previously introduced _UNTRUSTED_ENV_DENYLIST to prevent attacker-controlled .env files from redirecting execution. That fix did not enumerate every execution-routing key belonging to the same class.
Backend config-home and MCP/plugin root variables were among the omitted keys. Setting these variables redirects the nested agent, MCP servers, and plugin roster to attacker-controlled configuration paths. Additional variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes. Each omission weakens the approval gate that the runtime depends on for containment.
Root Cause
The root cause is an incomplete denylist [CWE-15: External Control of System or Configuration Setting]. The developers enumerated known-dangerous keys but did not systematically identify all environment variables that influence execution routing, backend selection, or approval class assignment.
Attack Vector
Exploitation requires local user interaction. A victim clones a malicious repository and opens it in Ouroboros. The runtime auto-loads the repository's .env file at import with no user prompt. The attacker sets environment variables that redirect the config-home, MCP servers, or plugin roster to attacker-controlled locations, or that lower approval classes and swap the execution backend. The agent then executes arbitrary attacker-supplied commands under the victim's user account.
No synthetic exploit code is published in this article. See the GitHub Security Advisory GHSA-jv2h-4p9v-wf5w for technical details.
Detection Methods for CVE-2026-66065
Indicators of Compromise
- Presence of .env files in cloned repositories that set Ouroboros backend, config-home, MCP, or plugin root variables.
- Unexpected child processes spawned by the Ouroboros runtime shortly after a repository is opened.
- Modifications to the user's shell history, SSH keys, or crontab immediately following an Ouroboros session.
- Outbound network connections from the Ouroboros process to attacker-controlled hosts.
Detection Strategies
- Inspect .env files in newly cloned repositories for keys that reference Ouroboros configuration paths, MCP servers, plugin rosters, or backend selection.
- Monitor process ancestry to flag command-line tools launched by the Ouroboros runtime that fall outside expected agent behavior.
- Alert on Ouroboros processes reading configuration from paths outside the user's canonical config-home directory.
Monitoring Recommendations
- Enable command-line and process-creation auditing on developer workstations that run AI coding agents.
- Log and review all environment variables loaded from project-directory .env files during Ouroboros startup.
- Track the installed Ouroboros version across the developer fleet and flag hosts below 0.42.1.
How to Mitigate CVE-2026-66065
Immediate Actions Required
- Upgrade Ouroboros to version 0.42.1 or later on all developer workstations.
- Audit any repositories cloned prior to the upgrade for suspicious .env files and remove them.
- Rotate any credentials, tokens, or SSH keys that were accessible on hosts running vulnerable Ouroboros versions.
Patch Information
The issue is fixed in Ouroboros 0.42.1. Release details are available in the GitHub Release v0.42.1 notes and the GitHub Security Advisory GHSA-jv2h-4p9v-wf5w.
Workarounds
- Do not open untrusted or unreviewed repositories in Ouroboros versions earlier than 0.42.1.
- Manually delete any .env file from a cloned repository before invoking the Ouroboros runtime.
- Run Ouroboros inside an isolated container or virtual machine with no access to sensitive credentials until patched.
# Configuration example: verify the installed Ouroboros version and remove untrusted .env files
ouroboros --version
find ./cloned-repo -maxdepth 2 -name '.env' -print -delete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
