Omnigent Authenticated RCE: Shared Agent Bundle Upload Bypasses MCP-Edit Restrictions (CVE-2026-62674)

What Happened

A GitHub Security Advisory (GHSA-jrrm-9hc7-2v3h, CVE-2026-62674) published September 2, 2026 details an authenticated remote code execution flaw in Omnigent, an AI agent runner platform distributed via pip. According to the advisory, the PUT /sessions/{session_id}/agent endpoint — used to upload a full agent bundle — checks only whether the caller has edit permission on their own session, and does not verify whether the bound agent is a shared/template agent (identified by agent.session_id is None). A separate, narrower endpoint for editing MCP servers directly does enforce that check, but the full-bundle upload path does not. This reportedly lets any authenticated user with normal session-edit access overwrite a shared/template agent — one the UI explicitly marks as not MCP-editable — by injecting a stdio MCP server into the uploaded bundle. Because stdio MCP servers launch as local subprocesses on the runner host, this results in attacker-controlled command execution. The advisory lists a CVSS of 9.0 and notes proof-of-concept exploit code is publicly available.

Why It Matters

This is not a privilege-escalation bug requiring special access — the advisory states a normal authenticated user with edit rights to their own session can trigger it. In multi-tenant or company-hosted Omnigent deployments where sessions are commonly spun up from shared/template agents, poisoning that shared bundle means every future session created from it inherits the attacker's malicious MCP server configuration and executes it with the permissions of the runner process. Per the advisory, this could expose runner-accessible files and credentials, allow tampering with workspace data, disrupt runner availability, or serve as a pivot point to internal services reachable from the runner.

What Defenders Should Do Now

• Identify whether your organization runs Omnigent (pip package) and check the affected version against the fix once one is released; the advisory suggests the remediation is adding the missing agent.session_id is None guard to the bundle-upload route.
• Until patched, consider restricting or monitoring who can call PUT /sessions/{session_id}/agent, especially against sessions bound to shared/template agents.
• Audit shared/template agent bundles for unexpected or newly added stdio MCP server entries, particularly ones referencing unfamiliar commands or binaries.
• Hunt for anomalous subprocess execution originating from Omnigent runner processes, and for outbound network connections from runner hosts that don't match expected MCP server behavior.
• Review runner host permissions — since exploitation inherits the runner process's access, tightening what that process can reach (files, credentials, internal network segments) limits blast radius even if the bug is triggered.

Developing Intel

This advisory was published today and details are based solely on the GHSA writeup; no public confirmation of in-the-wild exploitation has been reported, though PoC code is said to be available. We will monitor for a patched release and update as more information emerges. Full technical details: GHSA-jrrm-9hc7-2v3h.