p PatchFirst

CVE-2026-66065

CVE-2026-66065 · Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still reach arbitrary command execution by shipping a .env (auto-loaded at import, with no review step). The CVE-2026-47211 fix added _UNTRUSTED_ENV_DENYLIST to stop an untrusted project-directory .env from redirecting execution, but it did not account for all keys. The backend config-home and MCP/plugin roots bypass the approval gate by pointing the nested agent, MCP servers, and plugin roster at attacker config. Other variables re-enable blocked local transports, replace sub-agent prompts, switch backends, and lower tool approval classes, further weakening the approval gate. This issue has been fixed in version 0.42.1.

CVSS 8.4 · High · EPSS 0.2% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • ouroboros

    Versions
    • < 0.42.1: Affected

    No fix published

  • ouroboros-ai PyPI

    Versions
    • 0.1.0
    • 0.1.0a1
    • 0.1.1
    • 0.10.0
    • 0.11.0
    • 0.11.1
    • 0.12.0
    • 0.12.1
    • 0.12.2
    • 0.13.0
    • 0.13.1
    • 0.13.2
    • 0.13.3
    • 0.13.4
    • 0.13.5
    • 0.13.6
    • 0.13.7
    • 0.14.0
    • 0.14.1
    • 0.15.0
    • 0.16.0
    • 0.17.0
    • 0.18.0
    • 0.18.1
    • 0.19.0
    • 0.19.1
    • 0.2.0
    • 0.2.1
    • 0.2.2
    • 0.2.3
    • 0.20.0
    • 0.21.0
    • 0.21.1
    • 0.22.0
    • 0.23.0
    • 0.23.1
    • 0.23.2
    • 0.24.0
    • 0.25.0
    • 0.25.1
    • 0.25.2
    • 0.26.0
    • 0.26.0b1
    • 0.26.0b2
    • 0.26.0b3
    • 0.26.0b4
    • 0.26.0b5
    • 0.26.0b7
    • 0.26.1
    • 0.26.2
    • 0.26.3
    • 0.26.4
    • 0.26.5
    • 0.26.6
    • 0.27.0
    • 0.27.1
    • 0.27.2
    • 0.28.0
    • 0.28.1
    • 0.28.2
    • 0.28.3
    • 0.28.4
    • 0.28.5
    • 0.28.6
    • 0.28.7
    • 0.28.8
    • 0.29.0
    • 0.29.1
    • 0.29.2
    • 0.3.0
    • 0.30.0
    • 0.31.0
    • 0.31.1
    • 0.32.0
    • 0.33.0
    • 0.34.0
    • 0.35.0
    • 0.36.0
    • 0.36.1.dev20
    • 0.36.1.dev21
    • 0.36.1.dev22
    • 0.36.1.dev23
    • 0.36.1.dev24
    • 0.36.1.dev25
    • 0.36.1.dev26
    • 0.36.1.dev27
    • 0.36.1.dev28
    • 0.36.1.dev29
    • 0.36.1.dev30
    • 0.36.1.dev31
    • 0.36.1.dev32
    • 0.36.1.dev33
    • 0.36.1.dev34
    • 0.36.1.dev36
    • 0.36.1.dev41
    • 0.36.1.dev49
    • 0.36.1.dev50
    • 0.36.1.dev51
    • 0.36.1.dev52
    • 0.36.1.dev53
    • 0.36.1.dev54
    • 0.36.1.dev55
    • 0.36.1.dev56
    • 0.36.1.dev57
    • 0.36.1.dev58
    • 0.36.1.dev59
    • 0.36.1.dev60
    • 0.36.1.dev61
    • 0.36.1.dev62
    • 0.36.1.dev63
    • 0.36.1.dev64
    • 0.36.1.dev65
    • 0.36.1.dev66
    • 0.36.1.dev67
    • 0.36.1.dev68
    • 0.36.1.dev69
    • 0.36.1.dev70
    • 0.36.1.dev71
    • 0.37.0
    • 0.37.1.dev1
    • 0.37.1.dev10
    • 0.37.1.dev11
    • 0.37.1.dev12
    • 0.37.1.dev13
    • 0.37.1.dev14
    • 0.37.1.dev15
    • 0.37.1.dev16
    • 0.37.1.dev17
    • 0.37.1.dev18
    • 0.37.1.dev19
    • 0.37.1.dev2
    • 0.37.1.dev20
    • 0.37.1.dev21
    • 0.37.1.dev22
    • 0.37.1.dev23
    • 0.37.1.dev24
    • 0.37.1.dev25
    • 0.37.1.dev26
    • 0.37.1.dev27
    • 0.37.1.dev28
    • 0.37.1.dev29
    • 0.37.1.dev3
    • 0.37.1.dev30
    • 0.37.1.dev31
    • 0.37.1.dev32
    • 0.37.1.dev33
    • 0.37.1.dev34
    • 0.37.1.dev35
    • 0.37.1.dev36
    • 0.37.1.dev37
    • 0.37.1.dev38
    • 0.37.1.dev39
    • 0.37.1.dev4
    • 0.37.1.dev40
    • 0.37.1.dev5
    • 0.37.1.dev50
    • 0.37.1.dev51
    • 0.37.1.dev6
    • 0.37.1.dev7
    • 0.37.1.dev8
    • 0.37.1.dev9
    • 0.38.0
    • 0.38.1
    • 0.38.1.dev1
    • 0.38.1.dev2
    • 0.38.1.dev3
    • 0.38.1.dev4
    • 0.38.2
    • 0.38.2.dev3
    • 0.38.3.dev1
    • 0.38.3.dev10
    • 0.38.3.dev100
    • 0.38.3.dev101
    • 0.38.3.dev102
    • 0.38.3.dev103
    • 0.38.3.dev104
    • 0.38.3.dev105
    • 0.38.3.dev106
    • 0.38.3.dev107
    • 0.38.3.dev108
    • 0.38.3.dev109
    • 0.38.3.dev11
    • 0.38.3.dev110
    • 0.38.3.dev111
    • 0.38.3.dev112
    • 0.38.3.dev113
    • 0.38.3.dev114
    • 0.38.3.dev115
    • 0.38.3.dev116
    • 0.38.3.dev117
    • 0.38.3.dev118
    • 0.38.3.dev119
    • 0.38.3.dev12
    • 0.38.3.dev120
    • 0.38.3.dev121
    • 0.38.3.dev122
    • 0.38.3.dev123
    • 0.38.3.dev124
    • 0.38.3.dev125
    • 0.38.3.dev126
    • 0.38.3.dev127
    • 0.38.3.dev128
    • 0.38.3.dev129
    • 0.38.3.dev13
    • 0.38.3.dev130
    • 0.38.3.dev131
    • 0.38.3.dev132
    • 0.38.3.dev133
    • 0.38.3.dev134
    • 0.38.3.dev135
    • 0.38.3.dev136
    • 0.38.3.dev137
    • 0.38.3.dev138
    • 0.38.3.dev139
    • 0.38.3.dev14
    • 0.38.3.dev140
    • 0.38.3.dev141
    • 0.38.3.dev142
    • 0.38.3.dev143
    • 0.38.3.dev144
    • 0.38.3.dev145
    • 0.38.3.dev146
    • 0.38.3.dev147
    • 0.38.3.dev148
    • 0.38.3.dev149
    • 0.38.3.dev15
    • 0.38.3.dev150
    • 0.38.3.dev151
    • 0.38.3.dev152
    • 0.38.3.dev153
    • 0.38.3.dev154
    • 0.38.3.dev155
    • 0.38.3.dev156
    • 0.38.3.dev157
    • 0.38.3.dev158
    • 0.38.3.dev159
    • 0.38.3.dev16
    • 0.38.3.dev160
    • 0.38.3.dev161
    • 0.38.3.dev162
    • 0.38.3.dev163
    • 0.38.3.dev164
    • 0.38.3.dev165
    • 0.38.3.dev166
    • 0.38.3.dev17
    • 0.38.3.dev18
    • 0.38.3.dev19
    • 0.38.3.dev2
    • 0.38.3.dev20
    • 0.38.3.dev21
    • 0.38.3.dev22
    • 0.38.3.dev23
    • 0.38.3.dev24
    • 0.38.3.dev25
    • 0.38.3.dev26
    • 0.38.3.dev27
    • 0.38.3.dev28
    • 0.38.3.dev29
    • 0.38.3.dev3
    • 0.38.3.dev30
    • 0.38.3.dev31
    • 0.38.3.dev33
    • 0.38.3.dev4
    • 0.38.3.dev41
    • 0.38.3.dev43
    • 0.38.3.dev44
    • 0.38.3.dev45
    • 0.38.3.dev46
    • 0.38.3.dev47
    • 0.38.3.dev48
    • 0.38.3.dev49
    • 0.38.3.dev5
    • 0.38.3.dev50
    • 0.38.3.dev51
    • 0.38.3.dev52
    • 0.38.3.dev53
    • 0.38.3.dev54
    • 0.38.3.dev55
    • 0.38.3.dev56
    • 0.38.3.dev57
    • 0.38.3.dev6
    • 0.38.3.dev60
    • 0.38.3.dev66
    • 0.38.3.dev7
    • 0.38.3.dev76
    • 0.38.3.dev8
    • 0.38.3.dev86
    • 0.38.3.dev89
    • 0.38.3.dev9
    • 0.38.3.dev91
    • 0.38.3.dev93
    • 0.38.3.dev94
    • 0.38.3.dev98
    • 0.38.3.dev99
    • 0.39.0
    • 0.39.1
    • 0.39.1.dev1
    • 0.39.1.dev10
    • 0.39.1.dev11
    • 0.39.1.dev12
    • 0.39.1.dev13
    • 0.39.1.dev14
    • 0.39.1.dev15
    • 0.39.1.dev16
    • 0.39.1.dev17
    • 0.39.1.dev18
    • 0.39.1.dev19
    • 0.39.1.dev2
    • 0.39.1.dev20
    • 0.39.1.dev21
    • 0.39.1.dev22
    • 0.39.1.dev23
    • 0.39.1.dev24
    • 0.39.1.dev25
    • 0.39.1.dev26
    • 0.39.1.dev27
    • 0.39.1.dev28
    • 0.39.1.dev29
    • 0.39.1.dev3
    • 0.39.1.dev30
    • 0.39.1.dev31
    • 0.39.1.dev32
    • 0.39.1.dev33
    • 0.39.1.dev4
    • 0.39.1.dev5

    Update to 0.42.1

Original sources

Check your server →