CVE-2026-66065: Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added UNTRUSTEDENVDENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.42.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-66065?
The severity of CVE-2026-66065 is rated high with a score of 8.4.
How do I fix CVE-2026-66065?
To fix CVE-2026-66065, upgrade to Ouroboros version 0.42.1 or later.
What is the nature of the vulnerability in CVE-2026-66065?
CVE-2026-66065 involves untrusted .env files allowing for remote code execution due to omitted execution-routing keys.
Is my software affected by CVE-2026-66065?
Versions of Ouroboros prior to 0.42.1 are affected by CVE-2026-66065.
What can happen if CVE-2026-66065 is exploited?
If exploited, CVE-2026-66065 can allow a malicious actor to execute arbitrary code, compromising the security of the application.