CVE-2026-62674

Omnigent's full agent bundle upload endpoint, PUT /sessions/{session_id}/agent, lets an authenticated user with edit access to their own session overwrite a shared/template agent, because the route checks only the session edit permission and omits the guard that blocks edits to shared/template agents (those with a null session_id). An attacker exploits this by uploading a replacement bundle that adds a stdio MCP server to the shared agent, even though such agents are exposed as not MCP-editable through the normal edit path. Because stdio MCP servers are launched as local subprocesses by runners, every future session created from the poisoned shared agent executes the attacker-controlled command, giving authenticated remote code execution on runner hosts (CWE-94, CVSS 3.1 score 9.0 Critical). Any Omnigent server deployment (pip-installable) serving multiple authenticated users that relies on shared/template agents is affected; the advisory does not specify affected version numbers. Exploitation is not currently known: there is no public proof of concept, EPSS is 0.3% (27th percentile), and the flaw is not in the CISA KEV catalog.

What to do: Apply the advisory's suggested fix by adding the shared/template-agent guard (agent.session_id is null) to the PUT /sessions/{session_id}/agent route, and upgrade to a patched Omnigent release once the vendor publishes one. Until then, restrict the bundle upload endpoint to trusted users and audit existing shared/template agents for unexpected stdio MCP servers whose configured commands would execute on runner hosts.