Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.5

OmniRoute allows remote code execution via custom agent

CVE-2026-88062 · published 29 days ago
Summary

The OmniRoute AI gateway (versions 3.8.49 and earlier) lets anyone send a specially crafted request to its custom‑agent API that runs arbitrary commands on the server. If the system is set to allow anonymous access, an attacker can take control of the server container without needing credentials. Apply stricter authentication settings or block access to the /api/acp/agents endpoint until a patched version is released.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
– diegosouzapw omniroute < 3.8.49
npm – omniroute <= 3.8.50
Original advisory text
OmniRoute ACP Custom-Agent Remote Code Execution (RCE)
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSync executed the selected interpreter and arguments. The same request called refreshAgentCache, and resolveVersionProbe accepted the matched command before the execFileSync sink ran it. The tokenizeVersionCommand function and DISALLOWED_VERSION_COMMAND_CHARS filter rejected a limited set of shell metacharacters but still allowed interpreter evaluation arguments. The isAuthenticated function relied on isAuthRequired, which accepted anonymous requests when requireLogin was false, while api/acp/ was absent from LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES. With requireLogin=false or during a fresh-instance bootstrap window, a remote anonymous request could supply an interpreter evaluation argument and execute arbitrary code in the server container. With requireLogin=true and a configured management password, exploitation instead required a management session or management-scoped API key. No fixed version is available as of this review.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.5 Critical
Exploitation
1% chance of attack within 30 days
Type
CWE-94Code Injection
CWE-306Missing Authentication for Critical Function
Timeline
Published10 Sep 2026
Updated9 Oct 2026
First seen10 Sep 2026
Sources
CVE-2026-88062 · NVD
CVE-2026-88062 · MITRE
GHSA-hf57-cqmx-p4gr · GHSA
GHSA-hf57-cqmx-p4gr · OSV
CVE-2026-88062 · OSV
Track software like this
Free during beta