CVE-2026-62675

Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, multipart POST /v1/sessions accepts an authenticated user's agent bundle and omnigent/server/bundles.py validate_agent_bundle does not reject a tools..callable dotted Python path. omnigent/runner/tool_dispatch.py _resolve_spec_callable imports the specified module and _execute_spec_callable_tool invokes the resolved function, allowing a bundle to select subprocess.check_output and execute a local command with the runner process permissions. This can expose runner files, environment variables, credentials, workspace data, internal services, and availability without administrator access. This issue is fixed in version 0.3.0.

• CWE-94

• https://github.com/omnigent-ai/omnigent/commit/1f3f398f41cbf97b905133c21e848621c21da6e0
• https://github.com/omnigent-ai/omnigent/pull/1430
• https://github.com/omnigent-ai/omnigent/releases/tag/v0.3.0
• https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4
• https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-756x-9hf6-q4h4

Published

Aug 21, 2026

Last Modified

Sep 18, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6267GitLab has remediated an issue in GitLab CE/EE affecting all…5.3
• CVE-2026-62670Grav Flex Objects Plugin allows you to build custom collecti…6.3
• CVE-2026-62671Grav Login Plugin adds login, basic ACL, and session wide me…5.4
• CVE-2026-62672Grav is a file-based Web platform. Prior to 2.0.4, Grav allo…6
• CVE-2026-62673Grav is a file-based Web platform. Prior to 2.0.4, the Grav …8.2
• CVE-2026-62674Omnigent is an open-source AI agent framework and meta-harne…9
• CVE-2026-62676Omnigent is an open-source AI agent framework and meta-harne…7.1
• CVE-2026-62677Omnigent is an open-source AI agent framework and meta-harne…8.8
• CVE-2026-6268The EventPress WordPress theme before 22.2 does not sanitize…7.1
• CVE-2026-62680Orval generates type-safe JavaScript clients in TypeScript f…7.1
• CVE-2026-62681Orval generates type-safe JavaScript clients in TypeScript f…9.3
• CVE-2026-62682Orval generates type-safe JavaScript clients in TypeScript f…9.3