CVE-2026-88062
Received Received - Intake

Remote Code Execution in OmniRoute AI Gateway

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSync executed the selected interpreter and arguments. The same request called refreshAgentCache, and resolveVersionProbe accepted the matched command before the execFileSync sink ran it. The tokenizeVersionCommand function and DISALLOWED_VERSION_COMMAND_CHARS filter rejected a limited set of shell metacharacters but still allowed interpreter evaluation arguments. The isAuthenticated function relied on isAuthRequired, which accepted anonymous requests when requireLogin was false, while api/acp/ was absent from LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES. With requireLogin=false or during a fresh-instance bootstrap window, a remote anonymous request could supply an interpreter evaluation argument and execute arbitrary code in the server container. With requireLogin=true and a configured management password, exploitation instead required a management session or management-scoped API key. No fixed version is available as of this review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-11
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-88062
EUVD
EUVD-2026-75705

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
diegosouzapw omnioroute to 3.8.49 (exc)
diegosouzapw omnioroute 3.8.50

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-88062 is a critical Remote Code Execution (RCE) vulnerability in OmniRoute's ACP Custom-Agent functionality. The flaw exists in the /api/acp/agents endpoint, which allows unauthenticated users to execute arbitrary code on the server when requireLogin is set to false. The vulnerability arises because the endpoint accepts user-controlled binary and versionCommand values without proper validation.

Detection Guidance

Check if your OmniRoute instance has the /api/acp/agents endpoint exposed and if requireLogin is set to false. Use curl to test the endpoint with a crafted request: curl -X POST http://<target>/api/acp/agents -H 'Content-Type: application/json' -d '{"binary":"node","versionCommand":"-e \"require(\'fs\').writeFileSync(\'/tmp/test.txt\', \'pwned\')\""}' If the server responds with an error or file is created, the vulnerability is present.

Impact Analysis

An attacker can submit a specially crafted request with binary set to node and versionCommand containing malicious JavaScript code. The server executes this code via execFileSync, enabling full command execution within the container. This could lead to complete system compromise, data theft, or further network infiltration.

Compliance Impact

This vulnerability allows unauthenticated remote code execution (RCE) in the server container, which could lead to unauthorized access to sensitive data. For GDPR, this may result in data breaches violating Article 32 (security of processing) and Article 33 (notification of breaches). For HIPAA, it could compromise protected health information (PHI) under the Security Rule, leading to unauthorized access or disclosure.

Mitigation Strategies

Upgrade to OmniRoute v3.8.50 or later which includes fixes for this RCE vulnerability. If upgrading is not possible, set requireLogin to true and configure a strong management password. Restrict access to /api/acp/ by adding it to LOCAL_ONLY_API_PREFIXES and SP A WN_CAPABLE_PREFIXES. Block external access to the /api/acp/agents endpoint using network firewalls or reverse proxy rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart