# GHSA-rqfc-q7j9-5v59: Omnigent 0.18.0 Fixes Six Advisories, Two Critical: Session Imports Could Use Another User's Host, and Header Auth Trusted a Client-Set X-Forwarded-Email

> GHSA-rqfc-q7j9-5v59 is a critical-severity authentication bypass issue (CVSS 3.1 9.9) in omnigent, a package. Affected: <0.18.0. Fixed in 0.18.0.

- **Canonical URL:** https://catalog.anomity.ai/vuln/ghsa-rqfc-q7j9-5v59
- **Aliases:** ti-146
- **Severity:** critical
- **CVSS:** 9.9 (v3.1)
- **Attack type:** Authentication bypass, Sandbox escape
- **Component:** omnigent (package)
- **Package:** omnigent
- **Catalog entry:** https://catalog.anomity.ai/agent/omnigent
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-10-13
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/ghsa-rqfc-q7j9-5v59

## Summary

Omnigent, an open-source agent meta-harness that orchestrates Claude Code, Codex, Cursor and other agents with policies and sandboxing (omnigent on PyPI), published six GitHub security advisories on 13 and 14 October 2026, none with a CVE. Critical: GHSA-rqfc-q7j9-5v59 (CVSS 3.1 9.9), session imports could use another user's host without authorization (0.13.0.dev20260902 up to 0.18.0); and GHSA-x6v6-fg8x-997h (9.4), the default header authentication trusted a client-controlled X-Forwarded-Email header and allowed remote user impersonation (before 0.7.0). High: GHSA-v3vj-mch3-x6c2 (8.8), a sandbox launcher isolation failure that permitted host-level code execution; GHSA-jw77-57v9-jmcm (8.8), uploaded source tools running code with runner privileges; GHSA-h6vq-3549-mppq (8.3), git commands bypassing repository and branch policies; and GHSA-m3m2-42jg-grrv (CVSS 4.0 7.6), shell commands bypassing configured agent policies. All but the header issue are fixed in 0.18.0, published on 13 October. They follow three September advisories (GHSA-598r-29w2-g93q, critical, and two high) about os_env.cwd workspace escapes, fixed in 0.14.0.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| <0.18.0 | 0.18.0 |

## Am I affected by GHSA-rqfc-q7j9-5v59?

You are affected if you run omnigent <0.18.0. Versions 0.18.0 and later include the fix.

## How do I fix GHSA-rqfc-q7j9-5v59?

Upgrade omnigent to 0.18.0 or later and restart its server, agent and runner processes. If you rely on header authentication, make sure only your authenticating proxy can reach the server and that the proxy strips any client-supplied X-Forwarded-Email. Do not treat Omnigent shell or git policies as a security boundary on unpatched versions. Review session imports, uploaded tools and git activity for actions outside each user's own hosts and repositories, and rotate the credentials available to runners.

## References

- advisory: https://github.com/omnigent-ai/omnigent/security/advisories/GHSA-rqfc-q7j9-5v59

## Related vulnerabilities

- [CVE-2026-82533](https://catalog.anomity.ai/vuln/cve-2026-82533) — critical
- [CVE-2026-49468](https://catalog.anomity.ai/vuln/cve-2026-49468) — critical
- [CVE-2026-44338](https://catalog.anomity.ai/vuln/cve-2026-44338) — critical
- [GHSA-53mr-w429-c597](https://catalog.anomity.ai/vuln/ghsa-53mr-w429-c597) — high
- [CVE-2026-114090](https://catalog.anomity.ai/vuln/cve-2026-114090) — high
- [CVE-2026-115419](https://catalog.anomity.ai/vuln/cve-2026-115419) — high

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=ghsa-rqfc-q7j9-5v59