# Omnigent: six advisories hit agent policies, sandbox and multi-user auth

> Omnigent shipped fixes for six flaws that let one user reach another's host, forge an identity, escape the sandbox or dodge agent policies.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Vulnerability
- **Published by:** Omnigent
- **Disclosed:** 2026-10-13
- **Affects:** Omnigent
- **Research by:** Rea1mindxRing, TahirMars, sfwani, manus-pi, manus-use, fg0x0
- **Primary source:** https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-rqfc-q7j9-5v59
- **Page:** https://theinjection.dev/items/omnigent-multi-user-advisory-batch/

Omnigent, an agent meta-harness that orchestrates Claude Code, Codex and Cursor, published six security advisories on October 13 and 14, 2026. Two are rated critical. Most are fixed in 0.18.0, whose release notes do not mention them.

## What happened

Omnigent published six security advisories on October 13 and 14, 2026, five of them alongside version 0.18.0. The reporters named in them are Rea1mindxRing, TahirMars, sfwani, manus-pi, manus-use and fg0x0, and maintainer TomeHirata published each record. None of the six carries a CVE id.

## How it works

Three of the flaws are incomplete input lists, the weakness class CWE-184: Omnigent's GitHub and working-directory policies misread git global options and some shell syntax, so commands that should have needed approval ran unchecked. A fourth ran uploaded Python source tools during tool-schema discovery, which happens before the isolation that covers later tool calls. The session import path did not confirm that the chosen host belonged to the importing user. On Linux, the bubblewrap sandbox gave helper executors host temporary files, so code inside the sandbox could take over the launcher.

## Who is affected

Multi-user Omnigent servers carry the most risk, because four of the six advisories need an authenticated account on the server. Affected version ranges differ per advisory and are listed below. The header authentication flaw is the exception: no account is needed, and it reaches deployments below 0.7.0 that answer requests without a proxy that strips the X-Forwarded-Email header.

## What to do

Upgrade to Omnigent 0.18.0 or later and restart agent and runner processes, and do not rely on the changelog to flag the need, because the 0.18.0 release notes do not mention these fixes. Review imported sessions for host associations that do not belong to their owner and stop any session that should not reach its host. Operators who pin OMNIGENT_AUTH_PROVIDER=header should confirm their proxy strips client-supplied copies of the identity header.

## Quick facts

- **Advisories:** Six, published October 13 and 14, 2026, out of 13 the project has published since June
- **Critical:** Session import uses another user's host (CVSS 9.9), X-Forwarded-Email impersonation (CVSS 9.4)
- **High:** Sandbox launcher isolation and uploaded source tools (both CVSS 8.8), git policy bypass (8.3), shell policy bypass (7.6)
- **Affected:** The omnigent package on PyPI; ranges differ per advisory, most below 0.18.0
- **Fixed in:** 0.18.0 for five of them; the header impersonation flaw was fixed in 0.7.0
- **CVE:** None for the six October advisories. A seventh, the sub-agent os_env.cwd path traversal of September 16, got CVE-2026-112015 on October 18, 2026 (CVSS 7.7, fixed in 0.14.0)
- **Found by:** Rea1mindxRing, TahirMars, sfwani, manus-pi, manus-use and fg0x0; carfeii reported the sub-agent path traversal

## Questions

### Which Omnigent version fixes these advisories?

Omnigent 0.18.0, released October 13, 2026, patches five of the six advisories, and the sixth, the X-Forwarded-Email impersonation flaw, was already fixed in 0.7.0. Upgrading to 0.18.0 or later therefore covers all six. The advisories also ask operators to restart agent and runner processes after upgrading, because processes already running keep the old behaviour.

### Am I affected if I run Omnigent for just myself?

Single-user and local Omnigent installs face less exposure, because four of the six advisories require an authenticated account on a multi-user server. The sandbox launcher flaw still applies wherever agent code runs under bubblewrap on Linux. Omnigent also keeps source-tool support for trusted, operator-authored bundles on local or single-user servers after the fix.

### Do these Omnigent flaws have CVE ids?

No CVE id is assigned to any of the six advisories, and each GitHub record states that no known CVE exists, so tracking them needs the GHSA ids instead. Omnigent does carry CVEs for earlier flaws, including CVE-2026-62677 for an agent bundle path traversal fixed in 0.3.0, so the gap is specific to the October batch.

### How do I check whether another user reached my Omnigent host?

Review imported sessions on the server for host associations that do not belong to the owning user, which the critical advisory recommends directly, and stop any session that should not reach its host. Host identifiers can be visible to anyone able to view a shared session. Omnigent 0.18.0 verifies host ownership when an imported session is saved or replaced.

## Sources

1. [Session Import Advisory](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-rqfc-q7j9-5v59)
2. [Header Auth Advisory](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-x6v6-fg8x-997h)
3. [Sandbox Launcher GHSA](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-v3vj-mch3-x6c2)
4. [Source Tools GHSA](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-jw77-57v9-jmcm)
5. [Git Policy Bypass GHSA](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-h6vq-3549-mppq)
6. [Shell Policy Bypass GHSA](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-m3m2-42jg-grrv)
7. [Sub-Agent cwd GHSA](https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-p5x3-3gqh-x44g)
8. [CVE-2026-112015](https://www.vulncheck.com/advisories/omnigent-0.3.0-before-0.14.0-path-traversal-via-sub-agent-os-env-cwd)
9. [Omnigent 0.18.0 Release](https://github.com/omnigent-ai/omnigent/releases/tag/v0.18.0)