Listen to this Post
An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent. Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a `stdio` MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.
The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent. This route checks whether the caller can edit the session: `LEVEL_EDIT` session permission check. But it does not check whether the bound agent is a shared/template agent.
Shared/template agents have agent.session_id is None. The API already exposes that these agents are not meant to be MCP-editable: `mcp_servers_editable` is false for shared/template agents. The direct MCP edit endpoint correctly blocks shared/template agents with the guard: if agent.session_id is None: raise OmnigentError("Built-in agents are read-only through this endpoint."). The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row via agent_store.update(agent.id, new_loc). For shared/template agents, this changes the shared agent itself, not only the attacker’s session. This becomes command execution because `stdio` MCP servers start the configured command as a runner subprocess.
The suggested fix is to add the same `agent.session_id is None` guard to PUT /sessions/{session_id}/agent. This issue is fixed in version 0.3.0.
DailyCVE Form:
Platform: Omnigent
Version: <0.3.0
Vulnerability: AuthZ Bypass/RCE
Severity: Critical (CVSS 9.0)
Date: 2026-08-21
Prediction: Already Patched (0.3.0)
What Undercode Say:
Check Omnigent version pip show omnigent | grep Version Audit for unexpected changes in shared agent bundles Review session edit permissions List users with session edit rights
Exploit: (Educational Purposes!)
An attacker with edit access to their own session can:
1. Craft a malicious agent bundle containing a `stdio` MCP server that points to an attacker-controlled command.
2. Upload the bundle via `PUT /sessions/{session_id}/agent`.
- The shared/template agent is overwritten without any guard against
agent.session_id is None. - Future runner sessions using that shared agent will execute the attacker’s command.
The command executes with the permissions of the Omnigent runner process.
Protection:
- Upgrade to Omnigent version 0.3.0 or later immediately.
- Limit “edit” session permissions to trusted administrators.
- Audit existing shared agent bundles for unexpected changes.
- Review current users with session edit rights.
Impact:
This is authenticated RCE against Omnigent runner hosts. A normal authenticated user with edit access to their own session can poison a shared/template agent bundle, even though that agent is shown as not MCP-editable. The poisoned bundle can then be used by future sessions created from the same shared agent.
Because `stdio` MCP servers run as local subprocesses, the attacker-controlled command executes with the permissions of the Omnigent runner process. In a shared or company-hosted deployment, this can let an attacker read runner-accessible files and credentials, modify workspace data, disrupt runner availability, pivot to internal services reachable from the runner, or establish an interactive remote shell if outbound networking is allowed. This is high impact because it turns normal shared-agent session access into command execution on runner infrastructure used by other sessions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
