CVE-2026-116634 cheaper-inference CVE debrief

Who should care

Defenders responsible for OmniRoute deployments, particularly those with requireLogin disabled, should assess exposure and prioritize patching or mitigation efforts. This includes reviewing authentication configurations, verifying potential unauthorized access, and implementing compensating controls for exposed systems. Security teams and vulnerability management teams should track remediation progress and verify patched systems.

Why it matters

CVE-2026-116634 is a high-severity vulnerability in OmniRoute that allows unauthenticated attackers to issue sync tokens and retrieve sensitive information. Defenders should prioritize patching or mitigation efforts, especially for deployments with requireLogin disabled.

• Potential unauthorized access to decrypted provider credentials
• Potential unauthorized access to plaintext API keys
• Need to verify authentication configurations for OmniRoute deployments
• Priority on patching or mitigating the vulnerability

Technical summary

The vulnerability exists in OmniRoute versions 3.8.50 before 3.8.52, where an unauthenticated attacker can issue sync tokens via POST /api/sync/tokens when requireLogin is disabled. These tokens can be used to retrieve decrypted provider credentials and plaintext API keys from GET /api/sync/bundle. Defenders should prioritize patching or mitigating this vulnerability as soon as possible due to its high CVSS score of 8.2 and potential for unauthorized access to sensitive information. Affected product deployments should be identified, and owners assigned for follow-up.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability as soon as possible due to its high CVSS score of 8.2 and potential for unauthorized access to sensitive information.

Recommended defensive actions

• Patch OmniRoute to version 3.8.52 or later
• Disable requireLogin if not already done
• Monitor for suspicious activity on /api/sync/tokens and /api/sync/bundle endpoints
• Review and update authentication configurations for OmniRoute
• Perform vulnerability scanning to identify exposed systems
• Implement compensating controls for exposed systems
• Track remediation progress and verify patched systems

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to patch commits and technical descriptions. Defenders should verify authentication configurations for OmniRoute deployments, especially when requireLogin is disabled, and review potential unauthorized access to decrypted provider credentials and plaintext API keys. Limited source detail exists, so explicit evidence limits and defensive verification tasks are necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.