Ouroboros Incomplete Denylist Allows .env-Based RCE and Approval-Gate Bypass

Technical Analysis

The entry point is a project's .env file, which Ouroboros auto-loads at import time before any human review or approval gate is applied. A prior fix (CVE-2026-47211) introduced an _UNTRUSTED_ENV_DENYLIST to block known dangerous keys, but this patch was incomplete: backend config-home and MCP/plugin root variables were omitted, allowing an attacker to repoint the nested agent, MCP servers, and plugin roster at attacker-supplied configuration. Additional unblocked variables allow re-enabling disallowed local transports, overriding sub-agent system prompts, switching model backends, and downgrading tool approval classes, collectively neutralizing the runtime's policy enforcement. This crosses trust boundaries because a git clone of an untrusted repository — normally an inert action — becomes a code execution primitive the moment the agent runtime imports the project directory, and it further propagates trust abuse into any MCP servers or plugins the compromised config points to. The result is full arbitrary command execution on the developer's machine with no interactive consent step.

Affected Systems

Ouroboros; protocols: MCP

Detection Signatures

• Presence of unexpected .env files in cloned/untrusted repositories setting execution-routing variables (backend config-home paths, MCP server root paths, plugin roster paths, transport enable flags, sub-agent prompt overrides, tool approval class downgrades)
• Agent runtime logs showing config-home or MCP/plugin root values pointing outside the expected project or user config directory
• Unexpected changes to tool approval level immediately after project import with no user interaction
• Sub-agent system prompt values differing from repository-declared defaults after .env load
• Ouroboros version < 0.42.1 in dependency/version audit

Remediation Steps

1. 1

   Upgrade Ouroboros

   Update to version 0.42.1 or later, which completes the denylist coverage for execution-routing environment variables.

2. 2

   Treat repo .env files as untrusted input

   Disable auto-loading of .env files from freshly cloned or untrusted repositories, or require explicit user review/approval before import.

3. 3

   Enforce allowlist over denylist

   Where possible, switch environment variable handling from a denylist to a strict allowlist model for security-sensitive keys (backend config-home, MCP/plugin roots, transport flags, approval classes).

4. 4

   Isolate MCP/plugin roots

   Pin MCP server and plugin roster paths to a fixed, non-overridable trusted location independent of project-supplied environment variables.

5. 5

   Audit approval-gate integrity

   Add runtime checks that alert or block if tool approval class or transport settings change as a result of project-level configuration rather than explicit user action.