Odysseus AI Workspace Remote Code Execution via Authorization Bypass — GHSA-xwhc-f36c-v5vm (CVSS 9.9) — Threadlinqs Intelligence
As of 2026-08-06, Odysseus AI Workspace Remote Code Execution via Authorization Bypass — GHSA-xwhc-f36c-v5vm (CVSS 9.9) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 6 indicators of compromise.
Threat ID: TL-2026-1921 · Severity: CRITICAL · CVSS: 9.9 · Status: PATCHED · Category: VULNERABILITY
A critical vulnerability in Odysseus, a privacy-focused AI workspace for LLM interaction, allows any authenticated non-admin user to execute arbitrary OS commands with the privileges of the Odysseus
Odysseus is a multi-user, privacy-focused self-hosted AI workspace created by PewDiePie (Felix Kjellberg, handle archdaemon) providing chat with LLMs, autonomous agents, tools, model serving, email, and research capabilities. The project launched on May 31, 2026, rapidly accumulating over 62,000 GitHub stars and 300+ contributors. The threat model (THREAT_MODEL.md) defines a clear role-based access control (RBAC) boundary: shell and Python execution, file read/write, email, MCP tools, and vault access are admin-only capabilities. A scheduled tasks mechanism allows users to create jobs that run on schedules, webhooks, or manual triggers, with built-in actions including run_local, run_script, and ssh_command that execute shell commands on the host via Python's subprocess.run(script, shell=True).
Manifold Security discovered a critical authorization bypass allowing any authenticated non-admin user to execute arbitrary OS commands. The core defect was a state desynchronization across three code paths: the create gate in routes/task_routes.py checked whether the incoming request's task_type was "action" and the action was admin-only; the update gate checked whether the incoming request included an action field; and the scheduler dispatch in src/task_scheduler.py checked the stored task.task_type. No single code path asked whether the task as it stood would run a shell command — each evaluated only the fields the request happened to contain. By splitting the attack into two API calls, an attacker could assemble a privileged job from two individually unprivileged requests, with neither gate recognizing the full picture.
The first request creates a task with task_type set to "research" (a benign type bypassing the create gate) but attaches the admin-only run_local action. The create gate saw task_type="research" — not "action" — and never inspected the action field, persisting it to the database regardless. The second request updates only the task_type to "action" via a PUT endpoint. The update gate defaulted the action field to None in the request body, so the guard if req.action is not None evaluated as false and the admin privilege check never ran. With both modifications complete, the task carried task_type="action" (from the update) and action="run_local" (persisted from creation). Triggering the task via POST /api/tasks/{id}/run caused the scheduler to dispatch based on the stored task_type, executing arbitrary shell commands via subprocess.run(script, shell=True) with the privileges of the Odysseus process (uid 1000 in Docker).
Commands executed as the odysseus user with no sandboxing, filesystem confinement, or egress filtering. The project's own THREAT_MODEL.md acknowledges the absence of shell/filesystem sandboxing as a known gap. The process holds all sensitive application data: user password hashes (bcrypt) and TOTP secrets, stored provider AI API keys, the full application database, and SSH keys that Odysseus uses to access remote managed machines. On any instance with self-service signup enabled or more than one user, compromising a single non-admin account becomes a full foothold — attackers gain API keys to spend, a mailbox to send from, SSH keys to managed machines, and a scheduler mechanism for persistence. There is no evidence the issue was exploited before the fix.
The project consolidated five independent reports of the same defect. Manifold Security (Francisco Rosales) disclosed with a full Docker Compose PoC on June 8, 2026. The fix merged on July 5, 2026 in PR #5235 (commit 2826dcfc), binding the authorization decision to the task's effective final (task_type, action) pair, revalidating persisted state at every boundary (resume, manual-run, webhook, and scheduler dispatch), and pausing existing privileged rows owned by non-admin users rather than executing them. Odysseus has had additional security findings including CVE-2026-70619 (broken access control in embeddings endpoint, CVSS 8.8), CVE-2026-70620 (SS
Weaknesses (CWE)
CWE-863, CWE-306
Target sectors: technology, open-source-software, individuals, startups
Target regions: Global
Detections & IOCs
As of 2026-08-07, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 6 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1078, T1059, T1053, T1548, T1552, T1555, T1057, T1082, T1021, T1005
