GHSA-rqfc-q7j9-5v59: Omnigent 0.18.0 Fixes Six Advisories, Two Critical: Session Imports Could Use Another User's Host, and Header Auth Trusted a Client-Set X-Forwarded-Email
GHSA-rqfc-q7j9-5v59 is a critical-severity authentication bypass issue (CVSS 3.1 9.9) in omnigent, a package. Affected: <0.18.0. Fixed in 0.18.0.
Is omnigent running on your developers' machines? Anomity inventories the AI agents, MCP servers, extensions and skills on every developer device, so you can see what this advisory touches. Detect this across your developers' devices with Anomity →
Key facts
- ID
GHSA-rqfc-q7j9-5v59- Severity
- critical
- CVSS score
- 9.9 (v3.1)
- Attack type
- Authentication bypass, Sandbox escape
- Component
- Omnigent · package
- Package
omnigent- Known exploited
- No known exploitation
- Published
- Last verified
What is GHSA-rqfc-q7j9-5v59?
Omnigent, an open-source agent meta-harness that orchestrates Claude Code, Codex, Cursor and other agents with policies and sandboxing (omnigent on PyPI), published six GitHub security advisories on 13 and 14 October 2026, none with a CVE. Critical: GHSA-rqfc-q7j9-5v59 (CVSS 3.1 9.9), session imports could use another user's host without authorization (0.13.0.dev20260902 up to 0.18.0); and GHSA-x6v6-fg8x-997h (9.4), the default header authentication trusted a client-controlled X-Forwarded-Email header and allowed remote user impersonation (before 0.7.0). High: GHSA-v3vj-mch3-x6c2 (8.8), a sandbox launcher isolation failure that permitted host-level code execution; GHSA-jw77-57v9-jmcm (8.8), uploaded source tools running code with runner privileges; GHSA-h6vq-3549-mppq (8.3), git commands bypassing repository and branch policies; and GHSA-m3m2-42jg-grrv (CVSS 4.0 7.6), shell commands bypassing configured agent policies. All but the header issue are fixed in 0.18.0, published on 13 October. They follow three September advisories (GHSA-598r-29w2-g93q, critical, and two high) about os_env.cwd workspace escapes, fixed in 0.14.0.
Affected versions
| Affected | Fixed in |
|---|---|
<0.18.0 | 0.18.0 |
Am I affected by GHSA-rqfc-q7j9-5v59?
You are affected if you run omnigent <0.18.0. Versions 0.18.0 and later include the fix.
How do I fix GHSA-rqfc-q7j9-5v59?
Upgrade omnigent to 0.18.0 or later and restart its server, agent and runner processes. If you rely on header authentication, make sure only your authenticating proxy can reach the server and that the proxy strips any client-supplied X-Forwarded-Email. Do not treat Omnigent shell or git policies as a security boundary on unpatched versions. Review session imports, uploaded tools and git activity for actions outside each user's own hosts and repositories, and rotate the credentials available to runners.