OmniRoute vulnerabilities
CVEs whose affected-version data names the OmniRoute package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-116634Medium· 5.9OmniRoute 3.8.50 before 3.8.52 Missing Authentication via /api/sync/tokens
OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. Attackers can use the issued token against…
▾ Sunlitcheaper-inference · OmniRouteEPSS 0.50%via CVEORG
CVE-2026-88062Critical· 9.5PoCOmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers
OmniRoute is an open-source AI gateway providing a single endpoint for multiple model providers. In 3.8.49 and earlier, the OmniRoute POST /api/acp/agents custom ACP agent endpoint accepted attacker-controlled binary and versionCommand v…
▾ Abyssaldiegosouzapw · OmniRouteEPSS 1.4%via NVD