PT-2026-57220 · 9Router · 9Router

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-55641

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2

Description An unauthenticated remote attacker can bypass API-key authentication by sending a Host: localhost header, as the system incorrectly relies on the client-controlled Host header to determine if a request to the '/v1' LLM proxy endpoint is local. In default configurations, this allows unauthorized upstream provider calls using stored credentials. Additionally, the baseUrl parameter within the provider options of the '/v1/search' endpoint can be manipulated to trigger server-side requests to internal hosts or cloud-metadata services.

Recommendations Update to version 0.5.2.

Exploit

Fix

Authentication Bypass by Spoofing

SSRF

Weakness Enumeration

CWE-1327

CWE-348

CWE-290

CWE-918

Related Identifiers

CVE-2026-55641

Affected Products

9Router

References · 6

• 🔥 https://github.com/decolua/9router/security/advisories/GHSA-86m2-fcxq-5q7c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-55641 · Security Note
• https://github.com/decolua/9router/releases/tag/v0.5.2 · Note
• https://github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3 · Note
• https://twitter.com/CVEnew/status/2075613568439832668 · Twitter Post
• https://twitter.com/infoflowcloud/status/2075615086828232806 · Twitter Post