CVE-2026-66065 in Ouroboros
Summary
by MITRE • 08/04/2026
Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability described in CVE-2026-47211 represents a critical security flaw in the Ouroboros runtime system that affects versions prior to 0.42.1. This local-first AI coding agent runtime is designed to record agent actions and enforce user-defined policies to constrain behavior, making it essential for maintaining secure development environments. However, the vulnerability stems from an incomplete denylist implementation that fails to account for several execution-routing keys within the same remote code execution class. The flaw specifically exploits the automatic loading of .env files during import processes without any review mechanisms, creating a pathway for malicious actors to achieve arbitrary command execution through cloned repositories.
The technical implementation of this vulnerability involves multiple attack vectors that bypass the intended security controls. While version 0.42.1 introduced the _UNTRUSTED_ENV_DENYLIST variable to prevent untrusted project-directory .env files from redirecting execution, this fix was insufficient as it did not address all potential keys within the same class of execution routing. The backend configuration homes and MCP/plugin roots provide additional bypass mechanisms by allowing nested agents, MCP servers, and plugin rosters to point directly at attacker-controlled configurations. These bypasses enable attackers to manipulate critical system components through environment variable manipulation.
The operational impact of this vulnerability extends far beyond simple command execution capabilities. Variables that re-enable blocked local transports allow attackers to circumvent network restrictions that should prevent unauthorized communication channels. Additionally, the ability to replace sub-agent prompts enables attackers to modify the behavior of autonomous agents without detection. The vulnerability also permits switching backends and lowering tool approval classes, effectively weakening the entire approval gate mechanism that was designed to prevent unauthorized system modifications. This cascading effect creates multiple pathways for privilege escalation and persistent access within the development environment.
Security controls in this context align with CWE-78 and CWE-79 vulnerabilities related to command injection and cross-site scripting respectively, while the attack patterns resemble techniques documented in the MITRE ATT&CK framework under T1059.001 for command and script interpretation. The vulnerability demonstrates poor input validation and insufficient environment variable sanitization practices that are common in modern application security frameworks. Organizations using Ouroboros runtime systems should immediately implement mitigation strategies including immediate version upgrades to 0.42.1 or later, implementation of additional environment variable monitoring, and review of all configuration management processes. The fix implemented in version 0.42.1 represents a critical security patch that addresses the core denylist deficiency but requires comprehensive testing to ensure all bypass mechanisms have been properly mitigated across different deployment scenarios.