CVE-2026-62674: Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents. Prior to 0.3.0, PUT /ses

Omnigent, an open-source framework for managing AI agents that write code, has a permission bypass vulnerability in versions before 0.3.0. An authenticated user with edit access to a session can replace a shared agent (an agent template used across multiple sessions) and inject a malicious command that executes with the same permissions as the Omnigent process, potentially exposing sensitive data like files, credentials, and internal services.