Decolua 9Router vulnerabilities

CVE-2026-59800 [CRITICAL] CWE-78 CVE-2026-59800: 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /ap 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo

CVE-2026-59801 [CRITICAL] CWE-306 CVE-2026-59801: 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote a 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or del

CVE-2026-46339 [CRITICAL] CWE-78 CVE-2026-46339: 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware d 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

CVE-2026-63732 [CRITICAL] CWE-78 CVE-2026-63732: 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password ( 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log i

CVE-2026-62312 [HIGH] CWE-78 CVE-2026-62312: 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacke 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through

CVE-2026-55500 [CRITICAL] CWE-200 CVE-2026-55500: 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows f 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI

CVE-2026-62327 [CRITICAL] CWE-306 CVE-2026-62327: 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js A

CVE-2026-56679 [HIGH] CWE-915 CVE-2026-56679: 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the e 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole application, exposing protected routes such as /api/keys an

CVE-2026-55641 [HIGH] CWE-290 CVE-2026-55641: 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy re 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using

CVE-2026-55638 [HIGH] CWE-862 CVE-2026-55638: 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and / 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider

CVE-2026-56675 [HIGH] CWE-287 CVE-2026-56675: 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted a 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v

CVE-2026-63313 [HIGH] CWE-918 CVE-2026-63313: 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fet 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no

CVE-2026-62328 [HIGH] CWE-359 CVE-2026-62328: 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation histories including system prompts, user messages, assistant resp

CVE-2026-49352 [CRITICAL] CWE-798 CVE-2026-49352: 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in versio

CVE-2026-5842 [HIGH] CWE-285 CVE-2026-5842: A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Administrative API Endpoint. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. Upgrading to vers

CVE-2026-49353 [HIGH] CWE-290 CVE-2026-49353: 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local- 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

CVE-2026-55501 [HIGH] CWE-307 CVE-2026-55501: 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/ 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the attacker-controlled X-Forwarded-For HTTP header, and src/app/api/auth/login/route.js uses that spoofable value for checkLock and recordFail. A remote attacker can rotate the X-Forwarded-For value

CVE-2026-56676 [HIGH] CWE-367 CVE-2026-56676: 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled

CVE-2026-10269 [MEDIUM] CWE-266 CVE-2026-10269: A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the fu A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of the component HTTP Header Handler. The manipulation of the argument Host leads to improper authorization. The attack is possible to be carried out remotely. Upgrading to version 0.4.1 is capa

CVE-2026-56678 [MEDIUM] CWE-20 CVE-2026-56678: 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /ap 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-control