CVE-2026-56675: falha de alta gravidade em decolua 9router
9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.3epss 0.5%
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
decolua · 9routerCVEs relacionadas — decolua 9router
No mesmo produto, das mais perigosas para as menos.
CVE-2026-55638HIGH9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypassEPSS 6.6%CVE-2026-46339CRITICAL9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routesEPSS 2.8%CVE-2026-59800CRITICAL9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install EndpointEPSS 2.1%CVE-2026-56681HIGH9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip HeaderEPSS 1.1%CVE-2026-63732CRITICAL9router before 0.4.60 Remote Code Execution via default passwordEPSS 1.0%CVE-2026-62312HIGH9Router: Authenticated RCE via Unvalidated MCP Plugin ArgumentsEPSS 0.9%