{"id":"CVE-2026-112015","kind":"vulnerability","aliases":["CVE-2026-112015"],"related":[],"title":"Omnigent: authenticated users escape workspace and read host files","description":"Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.","summary":"Omnigent versions 0.3.0 through 0.14.0 (exclusive) let an authenticated user upload an agent bundle whose nested sub-agent sets os_env.cwd to an absolute or parent-traversing path. The root-only check in bundles.py does not block this, so the attacker can read and write host files as the runner user.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","omnigent","self-hosted"],"not_affected_if":["no-untrusted-bundle-uploads","upgraded-to-0.14.0"],"how_to_check":"- Check the installed Omnigent version and see whether it is at least `0.3.0` and below `0.14.0`.\n- Review uploaded bundles for sub-agents that set `os_env.cwd` to an absolute path or one containing `..`.","fix":"- Upgrade Omnigent to `0.14.0` or later.\n- Until upgraded, restrict who can upload bundles to trusted users.","status":"open","published_at":"2026-10-18T12:17:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:10:59+00:00","updated_at":"2026-10-25T03:10:59+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T03:10:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Omnigent to `0.14.0` or later.\n- Until upgraded, restrict who can upload bundles to trusted users.","reach":"unknown","title":"Omnigent: authenticated users escape workspace and read host files","impact":"high","summary":"Omnigent versions 0.3.0 through 0.14.0 (exclusive) let an authenticated user upload an agent bundle whose nested sub-agent sets os_env.cwd to an absolute or parent-traversing path. The root-only check in bundles.py does not block this, so the attacker can read and write host files as the runner user.","category":"ai-tooling","nicknames":[],"who_cares":["omnigent","ai-agents","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker reads and writes host files as the runner user.","analyst_note":"Confirm the default configuration and whether bundle upload is open to all authenticated users, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112015 and the upstream Omnigent 0.14.0 release notes.","how_to_check":"- Check the installed Omnigent version and see whether it is at least `0.3.0` and below `0.14.0`.\n- Review uploaded bundles for sub-agents that set `os_env.cwd` to an absolute path or one containing `..`.","needs_analyst":true,"not_affected_if":["upgraded-to-0.14.0","no-untrusted-bundle-uploads"],"who_is_affected":"Teams running Omnigent from 0.3.0 up to but not including 0.14.0 where authenticated users can upload agent bundles. Exposure depends on whether untrusted users can reach the bundle upload path; deployments already on 0.14.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000963,"input_tokens":3353,"output_tokens":1255,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112015':12A,15A '-2026':11A,14A '0.14.0':30B,82C '0.3.0':28B,80C 'absolut':49B,115C 'agent':18B,38B,44B,103C,112C 'ai':17B,20B 'ai-ag':16B 'ai-tool':19B 'allow':89C 'attack':68B,104C 'authent':2A,34B,90C 'block':64B 'bundl':39B,108C 'bundles.py':61B,128C 'bypass':122C 'check':59B 'contain':83C 'cve':10A,13A 'directori':121C 'escap':4A,93C 'exclus':31B 'file':9A,74B,134C 'host':8A,25B,73B,133C 'let':32B 'nest':41B,100C 'omnig':1A,22B,26B,79C 'os_env.cwd':46B,98C 'parent':52B,118C 'parent-travers':51B,117C 'path':54B,85C 'read':7A,70B,130C 'root':57B,124C 'root-on':56B,123C 'runner':77B,137C 'self':24B 'self-host':23B 'set':45B,97C 'sub':43B,102C,111C 'sub-ag':42B,101C,110C 'tool':21B 'travers':53B,86C,119C 'upload':36B,106C 'use':113C 'user':3A,35B,78B,91C,138C 'valid':126C 'version':27B 'vulner':87C 'whose':40B,109C 'work':120C 'workspac':5A,95C 'write':72B,132C","nicknames":[],"mitigations":[],"who_affected":"Teams running Omnigent from 0.3.0 up to but not including 0.14.0 where authenticated users can upload agent bundles. Exposure depends on whether untrusted users can reach the bundle upload path; deployments already on 0.14.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T12:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112015","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112015","severity":null,"published_at":"2026-10-18T12:17:14+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}