OmniRoute's ACP custom-agent registration is remote code execution, and it's anonymous whenever requireLogin is off.

CVE-2026-88062: POST /api/acp/agents accepts attacker-supplied binary and versionCommand, then calls execFileSync during version detection. The only validation is that the first token of versionCommand matches binary, which the attacker also supplies, so {"binary":"node","versionCommand":"node -e ..."} runs arbitrary Node in the container. With requireLogin=false, or during the bootstrap window before a management password exists, /api/acp/ isn't covered by the LOCAL_ONLY or spawn-capable prefixes (GHSA-hf57-cqmx-p4gr). A validation check where the attacker controls both sides of the comparison isn't a check.