Omnigent EUVD-2026-64016

Exploitation requires an authenticated account (PR:L per CVSS) that holds edit access (LEVEL_EDIT) to at least one session, and that session must be bound to a shared or template agent whose agent.session_id is None; the attacker abuses PUT /sessions/{session_id}/agent to replace that shared agent bundle and add a stdio MCP server. Exploitation is limited by several factors: the attacker cannot be fully unauthenticated (edit privilege on a session is mandatory), the deployment must actually use shared/template agents that other sessions reuse, and code execution only triggers when a later session launches the poisoned shared agent (UI:R), so a purely single-user or non-shared-agent deployment is not exposed. Only versions prior to 0.3.0 are affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, base 9.0) reflects a network-reachable, low-complexity attack requiring only low privileges but also user interaction and involving a scope change - the attacker's action in one session affects later, separate sessions using the shared agent. The privilege requirement (PR:L) means this is not an unauthenticated internet-wide threat: the attacker must already be an authenticated user holding edit access to some session, which points to insider or compromised-account abuse rather than mass exploitation. The UI:R component reflects that the malicious command fires only when a later session actually launches the poisoned shared agent, introducing a delay and a dependency on victim activity. No CISA KEV listing and no EPSS score were provided, and no public exploit code was identified, so real-world exploitation appears theoretical at present, but the payoff (RCE with runner-process permissions across shared infrastructure) is high, so operators running multi-tenant or team-shared Omnigent deployments should patch promptly. The scope change is the key aggravator here: one privileged tenant can poison an agent that other tenants unknowingly execute.

An authenticated Omnigent user who has been granted edit access to a session sends a PUT /sessions/{session_id}/agent request that targets a bound shared/template agent and injects a stdio MCP server pointing at an attacker-controlled command. Later, when a different session launches that shared agent, omnigent/tools/mcp.py spawns the malicious command with the runner process's permissions, exposing files, credentials, and internal services. No public exploit code was identified, but the low attack complexity makes weaponization straightforward for a user with the required session edit rights.