CVE-2026-88062 in OmniRoute
Summary
by MITRE • 09/10/2026
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSync executed the selected interpreter and arguments. The same request called refreshAgentCache, and resolveVersionProbe accepted the matched command before the execFileSync sink ran it. The tokenizeVersionCommand function and DISALLOWED_VERSION_COMMAND_CHARS filter rejected a limited set of shell metacharacters but still allowed interpreter evaluation arguments. The isAuthenticated function relied on isAuthRequired, which accepted anonymous requests when requireLogin was false, while api/acp/ was absent from LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES. With requireLogin=false or during a fresh-instance bootstrap window, a remote anonymous request could supply an interpreter evaluation argument and execute arbitrary code in the server container. With requireLogin=true and a configured management password, exploitation instead required a management session or management-scoped API key. No fixed version is available as of this review.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified within OmniRoute versions 3.8.49 and earlier represents a critical remote code execution flaw rooted in insufficient input validation and flawed authentication logic at the application layer. OmniRoute functions as an open-source AI gateway designed to provide a unified endpoint for interacting with multiple large language model providers. The specific weakness resides in the POST /api/acp/agents custom ACP agent endpoint, which serves as the primary attack vector. This endpoint accepts user-supplied binary and versionCommand parameters that are subsequently passed directly into system execution functions without adequate sanitization or restriction of allowed command arguments.
The technical mechanism of exploitation relies on the interaction between several internal components: execFileSync, refreshAgentCache, resolveVersionProbe, tokenizeVersionCommand, and DISALLOWED_VERSION_COMMAND_CHARS. When a request is received, the application attempts to validate the version command using a filter that rejects only a limited set of shell metacharacters via the DISALLOWED_VERSION_COMMAND_CHARS list. However, this filtering mechanism is incomplete because it fails to restrict interpreter evaluation arguments. Consequently, an attacker can supply valid but maliciously crafted argument strings that bypass the character-based filters while still triggering code execution when passed to execFileSync. The resolveVersionProbe function further exacerbates this issue by accepting matched commands before they are executed, effectively acting as a conduit for arbitrary command injection.
The operational impact of this vulnerability is severe, allowing for complete compromise of the server container hosting OmniRoute under specific configuration conditions. If the requireLogin setting is set to false or if the system is in a fresh-instance bootstrap window where authentication requirements are not yet enforced, an unauthenticated remote attacker can exploit this flaw with zero prior access. By sending a specially crafted HTTP POST request containing interpreter evaluation arguments within the versionCommand field, the attacker achieves arbitrary code execution on the host machine. This level of control enables data exfiltration, lateral movement within the network, and potential persistence mechanisms depending on the privileges of the process running OmniRoute.
In scenarios where requireLogin is enabled and a management password is configured, exploitation requires additional credentials or tokens. Specifically, an attacker must possess either a valid management session cookie or a management-scoped API key to bypass authentication checks. While this raises the barrier for initial access in hardened environments, it does not eliminate the risk entirely, as credential theft or misconfiguration can still lead to compromise. The absence of a fixed version at the time of review indicates that immediate mitigation through patching is unavailable, necessitating reliance on configuration-based defenses and network-level controls.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The failure to properly validate user-supplied input before passing it to system commands is the core deficiency. Furthermore, the authentication bypass aspect relates closely to CWE-287 Improvement of Authentication and CWE-306 Missing Authentication for Critical Function. In terms of adversary behavior, this exploitation technique maps to MITRE ATT&CK T1059 Command and Scripting Interpreter, specifically sub-techniques involving system shell commands or scripting interpreters like Python or Node.js, depending on the backend implementation used by OmniRoute.
Mitigation strategies must focus on immediate configuration hardening since no software patch is currently available. Administrators should ensure that requireLogin is strictly set to true for all production deployments and avoid using fresh-instance bootstrap windows in exposed environments. It is critical to restrict access to the /api/acp/ endpoint through network segmentation, firewalls, or reverse proxy rules to limit exposure only to trusted IP addresses or internal networks where possible. Additionally, implementing Web Application Firewall (WAF) rules that detect common command injection patterns and interpreter evaluation arguments can provide a layer of defense against exploitation attempts while waiting for an official vendor fix. Regular auditing of API gateway configurations and strict adherence to the principle of least privilege are essential steps in reducing the attack surface associated with this vulnerability.