CVE-2026-62674: Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{sessionid}/agent checks LEVELEDIT permission for a session but does not reject a bound shared or template agent whose agent.sessionid is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent to launch an attacker-controlled command through omnigent/tools/mcp.py. The command executes with the Omnigent runner process permissions and can expose files, credentials, workspace data, internal services, and runner availability. This issue is fixed in version 0.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnigentto a version that resolves this vulnerability.Fixed in 0.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Omnigent user who has LEVEL_EDIT permission on a session can exploit it when that session is bound to a shared or template agent. The attacker does not need direct access to the runner host.
What must happen for attacker-controlled code to run?
The attacker must replace the shared agent bundle and add a stdio MCP server. A later session using that shared agent then launches the attacker-controlled command with the Omnigent runner process permissions.
Are only the initially modified session and agent affected?
No. The modified shared or template agent can affect later sessions that use it, creating a cross-session impact. The runner command may expose files, credentials, workspace data, internal services, and runner availability.
What version fixes the issue?
Omnigent version 0.3.0 fixes this issue. Versions prior to 0.3.0 are affected.