CVE-2026-46339
published 2026-07-15CVE-2026-46339: 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing…
PriorityP277critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EXPLOIT
EPSS
4.57%
90.6th percentile
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| decolua | 9router | — | — |
| decolua | 9router | 0 – 0.4.55 | — |
| decolua | 9router | >= 0.2.21 < 0.4.45 | 0.4.45 |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
decolua 9router up to 0.4.36 Middleware src/proxy.js improper authentication
vuldb·2026-07-15·CVSS 10.0
CVE-2026-46339 [CRITICAL] decolua 9router up to 0.4.36 Middleware src/proxy.js improper authentication
A vulnerability classified as very critical has been found in decolua 9router up to 0.4.36. Affected by this issue is some unknown functionality of the file src/proxy.js of the component Middleware. Performing a manipulation results in improper authentication.
This vulnerability was named CVE-2026-46339. The attack may be initiated remotely. There is no available exploit.
GHSA
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
ghsa·2026-07-02
CVE-2026-49353 [HIGH] CWE-290 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
## Summary
The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in `src/dashboardGuard.js` that restricts spawn-capable routes (`/api/mcp/*`, `/api/tunnel/*`, `/api/cli-tools/*`) to loopback requests. The gate determines "local" by inspecting the `Host` and `Origin` HTTP headers rather than the TCP source address. When 9router is deployed behind a reverse proxy, tunnel (Cloudflare Tunnel, Tailscale — both natively supported), or is subject to DNS rebinding, these headers are attacker-controlled, allowing the local-only gate to be bypassed.
A second factor (CLI token or JWT cookie) is required by `canAccessLocalOnlyRoute()`, bu
GHSA
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
ghsa·2026-07-02
CVE-2026-49352 [CRITICAL] CWE-798 9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass
### Summary
9router uses a publicly known hardcoded string `"9router-default-secret-change-me"` as the fallback of JWT secret for all Dashboard session JWTs when the `JWT_SECRET` environment variable is not set. Because this secret is committed in the public repository and unchanged across all releases, any unauthenticated remote attacker can forge a valid `auth_token` cookie and gain full access to dashboard and api (If JWT_SECRET is not set on server) . This vulnerable affected so many public 9router server
### Details
| Versions | File | Note |
|---|---|---|
| `>= 0.2.21, = 0.4.31, /dashboard` - completely authentication bypass
### Attack Scenario:
- Attacker can use this JWT to spray to all server that they
GHSA
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
ghsa·2026-05-19
CVE-2026-46339 [CRITICAL] CWE-306 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
## Summary
9router exposes two unauthenticated API endpoints that, when chained together, allow any network-adjacent attacker to execute arbitrary OS commands as the user running the 9router process — with **zero prerequisites** and **no credentials required**.
The vulnerability exists because the Next.js middleware that enforces authentication (`src/proxy.js`) only guards 8 explicitly listed routes. The attack surface of `/api/cli-tools/*` and `/api/mcp/*` (40+ routes) receives **no authentication whatsoever**.
---
## Root Cause
### 1. Middleware Allowlist Is Too Narrow
**File:** `src/proxy.js`
```js
export const config = {
matcher: [
"/",
"/dashboard/:path*",
"/api/shutdown",
"/api/settings/:p
No detection rules found.
Nuclei
9Router <= 0.4.36 - Unauthenticated RCE
nuclei·CVSS 10.0
CVE-2026-46339 [CRITICAL] 9Router <= 0.4.36 - Unauthenticated RCE
9Router <= 0.4.36 - Unauthenticated RCE
9Router <= 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/* and /api/mcp/* entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, then GET /api/mcp/{name}/sse to trigger spawn() with the stored command resulting in unauthenticated remote code execution.
Template:
id: CVE-2026-46339
info:
name: 9Router <= 0.4.36 - Unauthenticated RCE
author: 0x_Akoko
severity: critical
description: |
9Router <= 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/* and /api/mcp/* entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a
No writeups or analysis indexed.
2026-07-15
Published