PT-2026-57222 · 9Router · 9Router

Published 2026-07-10 · Updated 2026-07-10 · CVE-2026-56675

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.2

Description 9Router treats loopback requests as trusted, allowing access to the /v1/* endpoints without an API key. When a same-host reverse proxy forwards public traffic to the backend via 127.0.0.1, the dashboardGuard.js function misclassifies external requests as local. This allows a remote unauthenticated attacker to access APIs such as /v1/models and potentially abuse configured upstream provider credentials through /v1 proxy endpoints, depending on the enabled providers.

Recommendations Update to version 0.5.2.

Fix

Authentication Bypass by Spoofing

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-290

CWE-441

CWE-306

CWE-287

Related Identifiers

CVE-2026-56675

Affected Products

9Router

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-56675 · Security Note
• https://github.com/decolua/9router/releases/tag/v0.5.2 · Note
• https://github.com/decolua/9router/security/advisories/GHSA-x5c9-v98j-722r · Note
• https://github.com/decolua/9router/commit/da667836cc7584bea0edd893de1d590c9ea279dc · Note
• https://twitter.com/infoflowcloud/status/2075615074161496358 · Twitter Post
• https://twitter.com/CVEnew/status/2075613564916699424 · Twitter Post