CVE-2026-62675: Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validateagentbundle does not reject a tools..callable dotted Python path. omnigent/runner/tooldispatch.py resolvespeccallable imports the specified module and executespeccallabletool invokes the resolved function, allowing a bundle to select subprocess.checkoutput and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Omnigentto a version that resolves this vulnerability.Fixed in 0.3.0 - Compensating control
If you cannot immediately upgrade, prevent authenticated users from uploading/using custom agent bundles for /v1/sessions (so multipart POST /v1/sessions cannot accept an agent bundle that could reference tools..callable dotted Python paths).
- Operational
After upgrading to 0.3.0, review for any potential exposure of runner files, environment variables, credentials, workspace data, internal services, and availability that may have occurred prior to the fix; rotate any potentially exposed credentials.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user who can submit an agent bundle to the multipart POST /v1/sessions endpoint can exploit it. Administrator access is not required.
What access does successful code execution have?
Commands run with the permissions of the Omnigent runner process. This can expose runner files, environment variables, credentials, workspace data, and internal services, and can affect availability.
Are installations running version 0.3.0 affected?
The issue is fixed in version 0.3.0. Versions prior to 0.3.0 are affected according to the available information.