Description

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent to launch an attacker-controlled command through omnigent/tools/mcp.py. The command executes with the Omnigent runner process permissions and can expose files, credentials, workspace data, internal services, and runner availability. This issue is fixed in version 0.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-08-21T18:16:49.460Z",
  "pubdate": "2026-08-21T18:16:49.460Z",
  "executiveSummary": "An improper permission validation and agent binding vulnerability exists in the Omnigent open-source AI agent framework prior to version 0.3.0.\nThe vulnerability resides in the PUT /sessions/{session_id}/agent route, which validates edit permissions for a session but fails to verify whether a bound shared or template agent possesses a null agent.session_id.\nAn authenticated user possessing edit access to a specific session can leverage this logic flaw to replace a shared agent bundle.\nBy successfully injecting a malicious stdio Model Context Protocol (MCP) server configuration into the replaced agent bundle, the attacker can hijack subsequent sessions that depend on the affected shared agent.\nWhen those subsequent sessions initialize, they trigger the execution of an attacker-controlled command via omnigent/tools/mcp.py.\nThe resulting command execution inherits the full execution context and permissions of the Omnigent runner process.\nThis leads to severe security implications, including arbitrary command execution, unauthorized exposure of sensitive files, credential harvesting, workspace data exfiltration, access to internal network services, and potential denial of service via runner availability disruption.\nSuccessful exploitation requires authenticated access with session edit privileges.",
  "technicalDetails": "The root cause of the vulnerability stems from incomplete access control and state validation logic within the session management subsystem of Omnigent, specifically located in omnigent/server/routes/sessions.py.\nWhen a client issues a PUT request to /sessions/{session_id}/agent, the application logic correctly checks the LEVEL_EDIT permission associated with the targeted session.\nHowever, the validation routine fails to restrict modifications when handling shared or template agents that lack a session binding (i.e., where agent.session_id is explicitly set to None).\nBecause of this missing validation constraint, an authenticated user with legitimate edit access to a single session can overwrite or manipulate the underlying shared agent bundle configuration utilized globally or across multiple sessions.\nThe attack flow proceeds as follows: First, the authenticated attacker targets an accessible session and submits a crafted payload to the vulnerable PUT endpoint.\nThis payload replaces the legitimate shared agent configuration with a malicious definition containing a stdio MCP server configuration within omnigent/tools/mcp.py.\nSecond, when subsequent independent sessions or user interactions invoke the compromised shared agent, the framework initializes the defined MCP server components.\nDuring this initialization phase, omnigent/tools/mcp.py spawns processes based on the stored configuration, thereby launching the attacker-controlled command.\nBecause the payload executes directly within the operational context of the Omnigent runner process, it inherits all associated operating system privileges and network access boundaries.\nPost-exploitation impact encompasses comprehensive system compromise from the perspective of the runner service.\nThe executing command can systematically read sensitive files, harvest environmental credentials, access internal microservices, exfiltrate workspace data, or disrupt runner availability.\nThe vulnerable component spans omnigent/server/routes/sessions.py and omnigent/tools/mcp.py across all versions prior to 0.3.0."
}