CVE-2026-62674
Received Received - Intake

Privilege Escalation in Omnigent AI Agent Framework

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent to launch an attacker-controlled command through omnigent/tools/mcp.py. The command executes with the Omnigent runner process permissions and can expose files, credentials, workspace data, internal services, and runner availability. This issue is fixed in version 0.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-62674
EUVD
EUVD-2026-64016

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
omnigent-ai omnigent 0.3.0
omnigent-ai omnigent to 0.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Omnigent, an open-source AI agent framework, allows an authenticated user with edit access to a session to replace a shared or template agent bundle via the PUT /sessions/{session_id}/agent endpoint. The issue occurs because the endpoint checks for LEVEL_EDIT permission but does not verify if the bound agent is a shared or template agent (indicated by agent.session_id being None). This oversight enables an attacker to inject a malicious stdio MCP server into the shared agent, which can execute arbitrary commands with the Omnigent runner process permissions when future sessions use the poisoned agent.

Detection Guidance

To detect this vulnerability, check if your Omnigent instance is running a version prior to 0.3.0. Use commands like 'pip show omnigent' or inspect the version in your deployment logs. Monitor for unauthorized PUT requests to /sessions/{session_id}/agent endpoints, especially targeting shared or template agents.

Impact Analysis

An attacker could exploit this vulnerability to execute arbitrary commands on the Omnigent runner host, potentially exposing sensitive files, credentials, workspace data, or internal services. The attack may also disrupt services or establish remote shells if outbound networking is available. The impact includes unauthorized data access, modification, or service disruption, all with the permissions of the Omnigent runner process.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Exposure of credentials or internal services may result in data breaches, triggering regulatory penalties, legal liabilities, and reputational damage for organizations using the affected Omnigent versions.

Mitigation Strategies

Upgrade Omnigent to version 0.3.0 or later immediately. Review session logs for suspicious PUT requests to /sessions/{session_id}/agent. Restrict LEVEL_EDIT permissions to trusted users only. Disable shared or template agent modifications until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62674. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart