CVE-2026-72860
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
An SSRF vulnerability in the POST /api/provider-nodes/validate route in 9router allows an attacker to make server-side requests to internal addresses, including loopback and link-local, due to flaws in the assertPublicUrl guard. Additionally, internal responses may be disclosed, and the API key is forwarded to internal destinations.
Risk Assessment
An attacker could scan internal ports, access internal services, and disclose parts of internal responses, potentially leading to confidentiality and integrity compromise.
Recommendation
Apply vendor patch or strengthen URL validation (e.g., by DNS resolution and IP address checks) and restrict forwarding of API keys to internal destinations.
Other vulnerabilities in 9router
See all- CVE-2026-56675High
9Router before version 0.5.2 treats loopback requests as trusted and allows /v1/* access without an API key. A same-host reverse proxy forwarding public traffic through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local, enabling a remote unauthenticated attacker to access /v1 APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints.
- CVE-2026-55638High
9Router before version 0.5.2 fails to protect the /codex path, allowing a remote unauthenticated attacker to bypass the API-key gate and send requests to /codex/*, which are rewritten to /api/v1/responses. The attacker can exploit this to make upstream provider calls using operator-stored LLM credentials.
- CVE-2026-55501High
In 9Router prior to version 0.4.80, the dashboard login rate limiter relies on the attacker-controlled X-Forwarded-For HTTP header. This allows bypassing the 5-attempt threshold and progressive lockout durations by rotating the header value on each login attempt.
- CVE-2026-63732Critical
9router 0.4.59 contains a chain of vulnerabilities: a hardcoded default password (123456), a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin to achieve arbitrary code execution on the host operating system.
- CVE-2026-49352Critical
In 9Router versions 0.2.21 through 0.4.44, a hardcoded fallback JWT secret '9router-default-secret-change-me' was used, allowing attackers to forge an auth_token cookie when JWT_SECRET is unset. The issue is fixed in version 0.4.44.
- CVE-2026-46339Critical
In 9Router versions 0.4.30 through 0.4.37, the middleware in src/proxy.js did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated plugin registration and command execution via the MCP bridge. This vulnerability is fixed in version 0.4.37.
- CVE-2026-62327Critical
9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.
- CVE-2026-59801Critical
9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.
- CVE-2026-55500Critical
In 9Router prior to version 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys, OAuth tokens, and settings) and full database import (complete overwrite) without any authentication requirement beyond the ALWAYS_PROTECTED middleware check, which only validates JWT or CLI token. This issue is fixed in version 0.4.80.
- CVE-2026-59800Critical
9Router before version 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint. The sudoPassword field from the request body is passed to the stdin of a 'sudo -S sh' process, allowing a remote unauthenticated attacker to execute arbitrary OS commands.
Original NVD description (English source)
The POST /api/provider-nodes/validate route in 9router takes a caller-supplied baseUrl and issues server-side HTTP requests to it, guarding the destination with assertPublicUrl from src/shared/utils/ssrfGuard.js. That guard compares hostname strings only: it resolves no DNS, does not revalidate after a redirect, and its IPv4-mapped IPv6 branch is unreachable. The branch matches ^::ffff:(\d+\.\d+\.\d+\.\d+)$, but the WHATWG URL parser canonicalizes such literals to hextets before the guard runs, so new URL("http://[::ffff:127.0.0.1]/").hostname yields [::ffff:7f00:1] and the pattern is tested against a string it is never handed. Every IPv4-mapped address therefore passes, and http://[::ffff:7f00:1] and http://[::ffff:a9fe:a9fe] reach loopback and link-local metadata addresses; a hostname whose A record points at an internal address passes as well because no resolution occurs. In the custom-embedding branch the upstream response body is truncated to 200 bytes and returned to the caller whenever the upstream status is neither 2xx nor 401 nor 403, which discloses the beginning of internal responses, and the other validation types remain usable for blind internal port scanning through status and timing differences. The caller-supplied apiKey is forwarded to the internal destination as an Authorization Bearer header. A dashboard session is required by default, and none is required when requireLogin is disabled.