# Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Authenticated user overwrites a shared/template agent bundle via PUT /sessions/{id}/agent, injecting a stdio MCP server that runs arbitrary commands on runner hosts.

- Payout: Research
- Severity: critical
- Program: Omnigent
- Found by: xttraa
- Disclosed: 2026-09-02
- CVE: CVE-2026-62674
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-jrrm-9hc7-2v3h
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-jrrm-9hc7-2v3h
- Tags: area:ai domain:ai domain:web impact:internal-access impact:rce kind:research platform:ghsa sev:critical tech:python technique:source-review vuln:access-control vuln:command-injection vuln:rce

**Target:** Agent bundle upload endpoint PUT /sessions/{session_id}/agent and stdio MCP server launcher
**Root cause:** The full agent bundle upload route checks only LEVEL_EDIT session permission and omits the `agent.session_id is None` guard that the direct MCP edit endpoint enforces, so shared/template agents can be replaced. Uploaded stdio MCP servers are then launched as runner subprocesses.
**Steps:**
1. Authenticate and obtain edit access to own session bound to a shared/template agent.
2. Send `PUT /sessions/{session_id}/agent` with a full agent bundle containing a `stdio` MCP server whose command is attacker-controlled.
3. Endpoint passes LEVEL_EDIT check, skips shared-agent guard, calls `agent_store.update(agent.id, new_loc)` mutating the shared agent.
4. Future sessions created from that shared agent start the stdio MCP subprocess, executing the attacker command on the runner.
**How found:** Noticed the API marks shared/template agents as `mcp_servers_editable: false` and the direct MCP edit endpoint blocks them via `agent.session_id is None`, then checked the parallel full-bundle upload route and found the same guard missing.
**Exploitation:** Attacker with normal session edit rights poisons a shared/template agent bundle; subsequent runner sessions using that agent spawn the attacker's stdio MCP command as a subprocess under runner permissions, enabling file/credential read, workspace tampering, internal pivoting, or a reverse shell if egress is allowed.
**Escalation:** Persistence across sessions via the shared agent: one poisoned bundle affects every future session created from it, not just the attacker's own.
**Insight:** When a product exposes a read-only flag on one endpoint, hunt sibling endpoints that mutate the same object (full-bundle upload vs. field-level edit) for the missing guard; the guard is usually duplicated per-route and one copy is forgotten.