Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| omnigent-ai | omnigent | before 0.3.0 | 0.3.0 | Patch available | CNA |
| — | omnigent (PyPI) | before 0.3.0 | 0.3.0 | Patch available | GHSA-756x-9hf6-q4h4 |
- omnigent Vendoromnigent-ai Affected before 0.3.0 Fixed in 0.3.0 Patch available CNA
- omnigent (PyPI) Vendor— Affected before 0.3.0 Fixed in 0.3.0 Patch available GHSA-756x-9hf6-q4h4
Remediation
- Fix · CNA omnigent (omnigent-ai) Fixed in 0.3.0
- Fix · GHSA-756x-9hf6-q4h4 omnigent (PyPI) Fixed in 0.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-62675
- 2026-10-03 Alias added: GHSA-756x-9hf6-q4h4
- 2026-10-16 EPSS moved to the 50th–90th percentile
References
Other 5
- https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4
- https://github.com/omnigent-ai/omnigent/pull/1430
- https://github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0
- https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0
- https://github.com/omnigent-ai/omnigent
More omnigent-ai vulnerabilities
- TI-2026-44785 Path traversal in omnigent-ai omnigent CVSS 3.1HIGH 8.8
- TI-2026-44782 Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE CVSS 3.1CRITICAL 9.0
- TI-2026-76167 Path traversal in Omnigent lets users read and write host files CVSS 4.0HIGH 7.7
- TI-2026-44784 Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py CVSS 3.1HIGH 7.1
Sources
- CVE-2026-62675 · CVE Program
- CVE-2026-62675 · NVD
- FIRST EPSS
- GHSA-756x-9hf6-q4h4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences