AIKIDO-2026-96665
ouroboros-ai is vulnerable to Authentication Bypass
81
High Risk
This Affects:
ouroboros-aiTL;DR
The MCP server exposes network transports (sse and streamable-http) that bind to a caller-supplied host and port. When bound beyond loopback, the server accepts requests without any authentication and lets callers invoke privileged tools such as ouroboros_execute_seed. That tool runs caller-supplied seed YAML with the agent runtime's local file and shell authority, so any reachable client can execute arbitrary agent workflows. The fix refuses non-loopback binds unless an auth token and an explicit remote-exposure flag are set, and adds Host/Origin validation and workspace-root confinement.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the MCP server on an sse or streamable-http transport bound to a non-loopback address reachable by untrusted clients.
Background info
ouroboros-ai is vulnerable to Authentication Bypass in versions 0.13.3 - 0.51.1.
How to fix this
Upgrade the ouroboros-ai library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.