OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

Published September 10, 2026 CVE-2026-88062

OmniRoute is a self-hosted gateway that connects apps to different AI providers. A remote attacker can send it one web request and run their own code on the server, without ever logging in, if the instance has login turned off or was never given a password.

Severity
CriticalCVSS 4.0 · 9.5
Affected versions
before 3.8.49
Weakness
CWE-94Code Injection
Exploit likelihood
0.40% in 30 daysEPSS, higher than 34% of known flaws
Affects
OmniRoute

How it works

  • OmniRoute lets a caller register a custom AI agent by supplying a program name and a command used only to check that program's version.
  • The only check performed is that the command starts with the same program name already supplied in the request, and both values come from the same request.
  • This lets an attacker name a real programming-language runtime as the program and hide extra instructions inside the version-check command, which OmniRoute then runs on the server.
  • The same request that registers the agent immediately triggers that check, so the code runs right away.
  • Normally an admin login would block this, but OmniRoute treats the request as trusted when login is turned off, or when the server is freshly installed and has not yet had a management password set.

What to do

Check your OmniRoute deployment's version with npm ls omniroute, since the GitHub advisory lists version 3.8.50 and all earlier versions as affected. Check your instance's settings for whether requireLogin is set to false, or whether it is a new install that has not yet had a management password configured, since either state removes the login requirement this flaw depends. Compare your findings against the GitHub Security Advisory GHSA-hf57-cqmx-p4gr for the current status.

Run this in the application environment you want to check:

npm ls omniroute

Turn on login by setting requireLogin to true and set a management password right away if you have not already, since that removes the anonymous access path this flaw relies. Watch the GitHub advisory for an official patched npm release, since it currently lists no patched version for this advisory. Ask the project maintainer whether your deployed build already includes the version-probe hardening that was merged toward a release/v3.8.50 branch, since the advisory and that fix branch do not clearly line up yet.

Technical details

The POST /api/acp/agents endpoint accepts attacker-controlled binary and versionCommand fields with only a self-consistency check (CWE-94), letting a matching interpreter such as node run an eval-style argument through execFileSync. The same request immediately triggers refreshAgentCache, so the payload executes without a second step. isAuthenticated treats anonymous callers as authenticated whenever requireLogin is false (CWE-306), and /api/acp/ is missing from both LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES, so the LOCAL_ONLY policy never intercepts it. CVSS v4 base score is 9.5. GitHub's advisory lists affected versions as 3.8.50 or older with no patched version; a related pull request shows version-probe hardening merged toward a release/v3.8.50 branch, but that is not confirmed as a published fixed release.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions Present Attack depends on particular deployment or execution conditions
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure High Sensitive data can be exposed with serious impact
  • Other systems: Data changes High Protected data can be changed with serious impact
  • Other systems: Service disruption High Severe or persistent loss of service in another system
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Open in FIRST.org calculator

References

View Original Source