CVE-2026-66065

CVE-2026-66065 reveals that the denylist added to fix CVE-2026-47211 was never going to work—not because the enumeration was incomplete, but because the approach is architecturally unsound. The previous patch added _UNTRUSTED_ENV_DENYLIST to block environment variable-based redirection, but that denylist lives in the same auto-loaded .env pipeline it was meant to secure. You cannot enumerate your way out of a trust model that grants auto-loading authority to untrusted directories. The current finding shows seven distinct bypass vectors flowing through that same pipeline: config-home redirection, MCP root injection, plugin roster manipulation, transport re-enablement, prompt substitution, backend switching, and approval-class degradation. These aren't zero-days the previous patch missed—they are consequences of the fix itself. The approval gate was designed as a single monolithic control point: compromising one variable doesn't open one door, it opens a cascade. config-home redirects the nested agent, MCP roots inject arbitrary servers, approval-class degradation removes friction from all subsequent actions. The blast radius of any single bypass is catastrophic by design. The core architectural failure is auto-loading .env at import time with no review step. When developers clone repos for exploration, they inherit silent configuration that shapes the runtime before the approval system even engages. The approval gate becomes theater—it signs off on a runtime already modified by untrusted configuration. What to check: audit your Ouroboros deployments for any .env files in cloned repositories or shared workspaces. Verify that MCP_ROOT, PLUGIN_ROSTER, and config-home paths are not being loaded from untrusted locations. Consider disabling auto-loading entirely and requiring explicit configuration loading as a containment primitive. The denylist approach will continue to fail because the attack surface and the policy enforcement mechanism are the same system.

Reviewed through automated stages and approved by a human before publication.