CVE-2026-88062: OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled binary and versionCommand values. After saving the custom agent, the same request calls refreshAgentCache() , which triggers agent version detection. The version probe eventually runs:

The only validation is resolveVersionProbe(binary, versionCommand, true) , which checks that the first token of versionCommand matches the request-provided binary . Because binary is also attacker-controlled, an attacker can submit:

This executes arbitrary Node.js code inside the server container, and that code can execute OS commands via child_process.execSync() .

When requireLogin=false , isAuthenticated() treats anonymous requests as authenticated. At the same time, /api/acp/ is not included in LOCAL_ONLY_API_PREFIXES or SPAWN_CAPABLE_PREFIXES , so the endpoint is not blocked by the LOCAL_ONLY policy before reaching the anonymous allow branch. As a result, a remote anonymous attacker can execute commands inside the OmniRoute container with a single HTTP request.

github.com /advisories/GHSA-hf57-cqmx-p4gr

github.com /diegosouzapw/OmniRoute/commit/60829241fd64d0317aa6a0dd8cd7a445a5287fed

github.com /diegosouzapw/OmniRoute/pull/11028

github.com /diegosouzapw/OmniRoute/security/advisories/GHSA-hf57-cqmx-p4gr

nvd.nist.gov /vuln/detail/CVE-2026-88062

Code Behaviors & Features

Detect and mitigate CVE-2026-88062 with GitLab Dependency Scanning