Exploitation ongoing with high activity in latest observed window (2 mentions)
Recommended action window: Immediate (within 24h)
NVD description
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand values and used only a self-consistency check before execFileSync executed the selected interpreter and arguments. The same request called refreshAgentCache, and resolveVersionProbe accepted the matched command before the execFileSync sink ran it. The tokenizeVersionCommand function and DISALLOWED_VERSION_COMMAND_CHARS filter rejected a limited set of shell metacharacters but still allowed interpreter evaluation arguments. The isAuthenticated function relied on isAuthRequired, which accepted anonymous requests when requireLogin was false, while api/acp/ was absent from LOCAL_ONLY_API_PREFIXES and SPAWN_CAPABLE_PREFIXES. With requireLogin=false or during a fresh-instance bootstrap window, a remote anonymous request could supply an interpreter evaluation argument and execute arbitrary code in the server container. With requireLogin=true and a configured management password, exploitation instead required a management session or management-scoped API key. No fixed version is available as of this review.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-11 | 2 | PoC2 |
| 2026-09-13 | 1 | PoC1 |
| 2026-09-15 | 1 | PoC1 |
| 2026-09-24 | 2 | Active Exploitation1Patch1 |
CVE-2026-88062 (CVSS 9.5): OmniRoute RCE Flaw PoC Disclosed https://securityonline.info/omniroute-rce-flaw-cve-2026-88062-poc/?utm_source=twitter&utm_medium=social_share
Post summary
The tweet announces that a proof‑of‑concept for CVE‑2026‑88062, an OmniRoute RCE flaw rated CVSS 9.5, has been disclosed, with no patch or active exploitation information.
Your AI model router might be a free RCE endpoint. CVE-2026-88062 : OmniRoute POST /api/acp/agents. Attacker sets binary=node and versionCommand=node -e "...". The only “guard” is that versionCommand starts with the same binary you just invented. Then refreshAgentCache → execFileSync. When requireLogin=false (or a fresh box with no admin password yet), one unauth POST shells the container. PoC + full repro: https://github.com/diegosouzapw/OmniRoute/security/advisories/GHSA-hf57-cqmx-p4gr Affects < 3.8.49. Shadowserver already seeing hits.
Post summary
A critical unauthenticated RCE vulnerability (CVE-2026-88062) in OmniRoute is actively being exploited, with a public PoC available and Shadowserver reporting real-world attacks against versions prior to 3.8.49.
🚨 CVE-2026-88062 - critical 🚨 OmniRoute < 3.8.49 - Unauthenticated RCE > OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validatio... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-88062 @pdnuclei #NucleiTemplates #cve
Post summary
The post announces a critical unauthenticated RCE in OmniRoute and points to a ProjectDiscovery Nuclei template resource, but does not confirm active exploitation, a named exploit tool, or an explicit remediation.
A critical CVSS 9.5 OmniRoute RCE flaw (CVE-2026-88062) has public PoC exploit code available. Upgrade your AI gateway immediately to prevent compromises. #OmniRoute #CVE202688062 #CyberSecurity #InfoSec #RCE https://securityonline.info/omniroute-rce-flaw-cve-2026-88062-poc/ https://t.co/mCw1f6QyeF
Post summary
The tweet announces CVE‑2026‑88062 as a critical RCE flaw on OmniRoute, highlights that public PoC exploit code is available, and urges users to upgrade immediately.
An API endpoint can turn an OmniRoute custom agent into code execution. CVE-2026-88062 "POST /api/acp/agents" accepts attacker-controlled agent configuration. The vulnerable version-probing logic can end up executing the supplied command. When login is disabled, the request can be made anonymously — no cookie, no Bearer token. The public advisory demonstrates command execution inside the OmniRoute container. Affected versions: <3.8.49 Fixed: 3.8.49 https://github.com/diegosouzapw/OmniRoute/security/advisories/GHSA-hf57-cqmx-p4gr #Cybersecurity #Infosec #LLMSecurity #RCE #Agents #AppSec
Post summary
The disclosure details an unauthenticated RCE in OmniRoute's custom agent API (CVE‑2026‑88062) where attacker‑controlled configuration can be executed via flawed version probing, affecting versions before 3.8.49; version 3.8.49 includes the fix.
CVE-2026-88062 (CVSS 9.5): OmniRoute RCE Flaw PoC Disclosed - https://securityonline.info/omniroute-rce-flaw-cve-2026-88062-poc/
Post summary
The post announces that a PoC for CVE-2026-88062, an RCE flaw in OmniRoute with a CVSS score of 9.5, has been disclosed and links to the PoC.