Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /sessions/{session_id}/agent checks LEVEL_EDIT permission for a session but does not reject a bound shared or template agent whose agent.session_id is None. An authenticated user with edit access to a session can replace that shared agent bundle through omnigent/server/routes/sessions.py, add a stdio MCP server, and cause later sessions that use the shared agent to launch an attacker-controlled command through omnigent/tools/mcp.py. The command executes with the Omnigent runner process permissions and can expose files, credentials, workspace data, internal services, and runner availability. This issue is fixed in version 0.3.0.

CVE-2026-62674 affects Omnigent, an open-source AI agent framework for orchestrating coding agents, in versions prior to 0.3.0. The vulnerability exists in the PUT /sessions/{session_id}/agent endpoint, which checks LEVEL_EDIT permissions but fails to reject bound shared or template agents with a null agent.session_id. An authenticated user with edit access to a session can replace a shared agent bundle, inject a malicious stdio MCP server, and cause subsequent sessions using that shared agent to execute attacker-controlled commands. The commands run with Omnigent runner process permissions, potentially exposing files, credentials, workspace data, and internal services. The attack vector requires authentication but allows privilege escalation through the shared agent mechanism. Affected code paths include omnigent/server/routes/sessions.py and omnigent/tools/mcp.py. The vulnerability has been fixed in version 0.3.0 via a patch available on GitHub.