Product
OmniRoute contains a critical remote code execution vulnerability (CVE-2026-88062) in the /api/acp/agents endpoint, allowing anonymous attackers to execute arbitrary code when requireLogin is disabled.