CVE-2026-56676
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
9Router prior to version 0.5.2 is vulnerable to a DNS rebinding attack. Image URL validation resolves the host before fetching, but the actual fetch performs a separate DNS resolution, allowing an attacker to redirect requests to internal HTTP services.
Risk Assessment
An authenticated attacker with access to the LLM proxy can use a vision-capable model and a controlled DNS name to access internal HTTP services, potentially leading to data leakage or privilege escalation.
Recommendation
Immediately upgrade 9Router to version 0.5.2 or later, which includes a fix for the DNS rebinding vulnerability.
Other vulnerabilities in 9Router
See all- CVE-2026-56675High
9Router before version 0.5.2 treats loopback requests as trusted and allows /v1/* access without an API key. A same-host reverse proxy forwarding public traffic through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local, enabling a remote unauthenticated attacker to access /v1 APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints.
- CVE-2026-55638High
9Router before version 0.5.2 fails to protect the /codex path, allowing a remote unauthenticated attacker to bypass the API-key gate and send requests to /codex/*, which are rewritten to /api/v1/responses. The attacker can exploit this to make upstream provider calls using operator-stored LLM credentials.
- CVE-2026-55501High
In 9Router prior to version 0.4.80, the dashboard login rate limiter relies on the attacker-controlled X-Forwarded-For HTTP header. This allows bypassing the 5-attempt threshold and progressive lockout durations by rotating the header value on each login attempt.
- CVE-2026-63732Critical
9router 0.4.59 contains a chain of vulnerabilities: a hardcoded default password (123456), a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin to achieve arbitrary code execution on the host operating system.
- CVE-2026-49352Critical
In 9Router versions 0.2.21 through 0.4.44, a hardcoded fallback JWT secret '9router-default-secret-change-me' was used, allowing attackers to forge an auth_token cookie when JWT_SECRET is unset. The issue is fixed in version 0.4.44.
- CVE-2026-46339Critical
In 9Router versions 0.4.30 through 0.4.37, the middleware in src/proxy.js did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated plugin registration and command execution via the MCP bridge. This vulnerability is fixed in version 0.4.37.
- CVE-2026-62327Critical
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.
- CVE-2026-59801Critical
9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.
- CVE-2026-55500Critical
In 9Router prior to version 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.
- CVE-2026-59800Critical
9Router before version 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint. The sudoPassword field from the request body is passed to the stdin of a 'sudo -S sh' process, allowing a remote unauthenticated attacker to execute arbitrary OS commands.
Original NVD description (English source)
9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.