External risk intelligence

OmniRoute Arbitrary Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-88062

OmniRoute functions as an AI gateway designed to provide a public or shared endpoint for multiple model providers. As a gateway service, it is intended to be network-accessible to handle requests. The vulnerable endpoint is part of the API surface, and the service supports anonymous access or configuration patterns that make it inherently reachable as an internet-facing service.

Code Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in OmniRoute, an open-source AI gateway. This issue could allow an unauthenticated remote attacker to execute arbitrary code on the server, posing a significant risk to system integrity. The main concern at this stage is confirming if this technology is in use and if it is exposed externally.

Code execution flaw in an AI gateway.
Threat allows remote, unauthenticated attackers.
Confirm relevance and exposure to AI services.

Attack Path

How an attacker could exploit the issue

An attacker could remotely send a specially crafted request to the OmniRoute API, targeting the custom agent endpoint. If the service is configured to allow anonymous access or during a bootstrap phase, the attacker can provide malicious commands that the system will execute on the server. This could lead to the execution of arbitrary code within the server's container.

Unauthenticated network access is required.
Attacker sends a POST request to the agent endpoint.
Arbitrary code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

When the `requireLogin` setting is false or during a specific bootstrap window, an anonymous remote attacker could supply an interpreter evaluation argument to the ACP agent endpoint. This could allow for the execution of arbitrary code within the server container. With `requireLogin` set to true and a management password configured, exploitation would require a management session or a management-scoped API key.

Server container code execution.
Exploitation via network request.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this critical vulnerability lies with teams managing the OmniRoute AI gateway, likely platform or infrastructure teams responsible for its deployment and configuration. The first practical move is to identify all OmniRoute instances, confirm their network exposure and business criticality, and then locate the accountable owner to plan a coordinated remediation.

Platform/Infrastructure teams own the issue.
Verify network exposure and critical assets.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OmniRoute?

OmniRoute is an open-source AI gateway that serves as a central hub for managing and routing requests across various AI model providers. By providing a single endpoint for these services, it acts as a traffic controller, enabling applications to interact with multiple AI backends seamlessly. It is designed to sit between users or internal systems and the actual model services to unify communications and simplify integration for developers.

What is the vulnerability in CVE-2026-88062?

This CVE involves a critical flaw categorized as CWE-94 (Improper Control of Generation of Code) and CWE-306 (Missing Authentication for Critical Function). Essentially, the software fails to properly sanitize inputs at a specific API endpoint, allowing an attacker to inject and execute arbitrary commands. Because the system improperly evaluates these inputs before passing them to an execution sink, it risks server-side code execution.

How does an attacker trigger this issue?

The trigger involves sending a crafted POST request to the application's agent endpoint. If the system is configured without mandatory authentication—or during its initial bootstrap window—an anonymous remote attacker can bypass security controls. Notably, this does not occur if authentication is strictly enforced with a management password and valid session keys, as those controls prevent unauthorized access to the vulnerable code path.

Is my installation at risk?

Halo Surface Signal indicates that OmniRoute is often deployed as a public-facing gateway, making it inherently reachable over the network to handle incoming AI model requests. If your instance is accessible from the internet, it faces a higher probability of being reached by external actors. You should prioritize instances configured with anonymous access enabled, as these are the most direct targets for this vulnerability.

What should I do to secure my environment?

Begin by identifying all running OmniRoute instances and verifying their network reachability. Check your specific configuration to see if anonymous access or the bootstrap settings are currently active, as these increase risk. Since no software update is currently available, focus on restricting network access to trusted users and ensuring that mandatory authentication is fully enabled for all management endpoints until an official fix is released.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.