CVE-2026-62675

CVE-2026-62675 is an authenticated remote-code-execution flaw (CWE-94) in the Omnigent server/runner: uploaded agent bundles may define server-side Python callable tools, and the bundle validator (validate_agent_bundle) does not reject `tools.<name>.callable` entries even though Python callable tools are intended as a trusted operator-only feature. An authenticated user triggers it by uploading a crafted bundle through the multipart `POST /v1/sessions` endpoint (the same path used by the Web UI's custom-agent flow, or directly via the API/CLI from agent YAML); when the uploaded agent's tool is invoked, the runner imports the attacker-specified dotted Python path (e.g., `subprocess.check_output`) via importlib and calls it, executing an arbitrary local command on the runner machine. A successful attacker gains code execution on the runner host with the runner's privileges, producing high confidentiality, integrity, and availability impact (CVSS 3.1: 8.8 High, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are hosted or self-hosted Omnigent deployments that expose session creation to ordinary authenticated users, especially multi-tenant setups with shared or managed runner hosts. No public PoC, KEV listing, or confirmed in-the-wild exploitation is known; EPSS estimates roughly a 0.4% probability of exploitation within 30 days.

What to do: Upgrade Omnigent (pip) to a release containing the bundle-validation fix as soon as one is published — no fixed version is stated in the available data, so track the omnigent-ai advisory/repository. Interim mitigations: restrict which authenticated users may upload custom agent bundles, disallow or allowlist `tools.<name>.callable` entries in uploaded bundles (including enforcing the policy-handler allowlist for callable tools), and run runners with least privilege on hosts where multi-user command execution is high impact. Prioritize deployments that expose `POST /v1/sessions` to ordinary users against shared or managed runner hosts, as these are the highest-risk configurations.