/Vulnerability Library

OmniRoute < 3.8.49 - Unauthenticated RCE

CVE-2026-88062
Verified

Description

OmniRoute <= 3.8.49 contains a remote code execution caused by insufficient validation of interpreter arguments in the POST /api/acp/agents endpoint, letting remote attackers execute arbitrary code, exploit requires anonymous access when requireLogin is false or management session/API key when true.

Severity

Critical

CVSS Score

9.5

Exploit Probability

1%

Affected Product

omniroute

Published Date

September 15, 2026

Template Author

0x_akoko

CVE-2026-88062.yaml
9.5Score

CVSS Metrics

CVE ID:
cve-2026-88062
CWE ID:
cwe-94, cwe-306

References

https://github.com/diegosouzapw/OmniRoute/security/advisories/GHSA-hf57-cqmx-p4grhttps://github.com/diegosouzapw/OmniRoute/pull/11028https://nvd.nist.gov/vuln/detail/CVE-2026-88062

Remediation Steps

Update to the latest version once a fix is available.