OmniRoute CVE-2026-88062

Requires the OmniRoute /api/acp/agents endpoint to be network-reachable AND one of: requireLogin=false (anonymous access accepted by isAuthRequired), or a fresh-instance bootstrap window before a management password is configured. The attacker must supply a 'versionCommand' whose binary matches an expected interpreter (node/python/ruby) but includes an evaluation argument such as '-e' or '-c'. Limiting factors: if requireLogin=true with a configured management password, exploitation instead requires a valid management session or management-scoped API key (no longer anonymous); the endpoint being spawn-capable but omitted from LOCAL_ONLY_API_PREFIXES/SPAWN_CAPABLE_PREFIXES is what removes the local-only guard. The CVSS AT:P reflects these configuration/timing prerequisites.

This is a genuine high-priority issue in the exposed configuration: the CVSS 4.0 base score is 9.5 with AV:N/AC:L/PR:N/UI:N and full VC/VI/VA plus subsequent-system impact, reflecting network-reachable, unauthenticated code execution. The AT:P (attack requirement present) metric is the honest qualifier - exploitation depends on requireLogin=false or hitting the fresh-instance bootstrap window before a management password is set; with requireLogin=true and a configured management password, an attacker instead needs a management session or management-scoped API key, which sharply reduces exposure. No EPSS score, KEV listing, or standalone POC is provided, so there is no evidence of active exploitation and no public exploit identified at time of analysis; however, the vendor advisory (GHSA-hf57-cqmx-p4gr) and a regression test in the fix PR describe the exact eval-payload PoC, so weaponization is straightforward. The signals are internally consistent (network RCE, conditional preconditions), so any operator running an internet-reachable instance with login disabled - or newly bootstrapped instances - should treat this as urgent and prioritize the config-level mitigation until a patched release ships.

An attacker discovers an internet-exposed OmniRoute instance running with requireLogin=false (or catches one in its fresh-install bootstrap window) and sends an anonymous POST to /api/acp/agents registering a custom ACP agent whose binary and versionCommand both name 'node' with an argument of '-e <payload>'. The binary-match check passes, execFileSync runs node with the eval payload, and arbitrary code executes inside the server container; the advisory documents this exact PoC shape though no standalone exploit is published.