Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE

Summary

An authenticated user with edit access to their own session can overwrite a shared/template agent by uploading a full agent bundle through PUT /sessions/{session_id}/agent.

Shared/template agents are shown as not MCP-editable, but this upload path still accepts a replacement bundle. By adding a stdio MCP server to the shared agent, the attacker can cause future runner sessions using that shared agent to start an attacker-controlled command.

Details

The vulnerable endpoint is the full agent bundle upload route: PUT /sessions/{session_id}/agent This route checks whether the caller can edit the session: LEVEL_EDIT session permission check But it does not check whether the bound agent is a shared/template agent. Shared/template agents have:

agent.session_id is None

The API already exposes that these agents are not meant to be MCP-editable: mcp_servers_editable is false for shared/template agents The direct MCP edit endpoint correctly blocks shared/template agents: session_mcp_servers.py shared-agent guard

if agent.session_id is None:
    raise OmnigentError("Built-in agents are read-only through this endpoint.")

The full bundle upload endpoint is missing that same guard. It stores the uploaded bundle and updates the agent row: agent_store.update(agent.id, new_loc) For shared/template agents, this changes the shared agent itself, not only the attacker's session. This becomes command execution because stdio MCP servers start the configured command as a runner subprocess: stdio subprocess launch