Description Summary:
A Server-Side Request Forgery vulnerability in the 9router /api/provider-nodes/validate endpoint allows authenticated users to bypass SSRF protection and send requests to arbitrary destinations.

Executive Summary:
An authenticated Server-Side Request Forgery vulnerability in 9router allows attackers to bypass security guards and issue arbitrary requests from the server.

Vulnerability Details

CVE-ID: CVE-2026-72860

Affected Software: decolua 9router

Affected Versions: 0 through 0.5.55

Vulnerability: This is a CWE-918 Server-Side Request Forgery vulnerability combined with CWE-184 Incomplete List of Disallowed Inputs. The validation logic for the baseUrl parameter fails to properly block IPv4-mapped IPv6 addresses, allowing an authenticated attacker to reach forbidden destinations.

Business Impact

While the attack requires low privileges, the ability to bypass SSRF protections can be used to scan internal network services that are otherwise unreachable from the public internet. With a CVSS score of 8.5, this vulnerability represents a significant risk to internal network privacy and could be used as a stepping stone for further exploitation of internal microservices.

Remediation Plan

Immediate Action: Update 9router to the latest available version that includes the patch for the ssrfGuard utility.

Proactive Monitoring: Monitor API usage logs for the /api/provider-nodes/validate endpoint, focusing on requests that contain suspicious IP addresses or internal hostnames.

Compensating Controls: Implement network-level egress restrictions on the application server to prevent it from communicating with internal-only network ranges that do not require external access.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically significant because it demonstrates how incomplete blocklists for input validation can lead to bypasses of intended security controls.

Analyst Recommendation

Organizations should prioritize updating 9router to mitigate this SSRF risk. Although the vulnerability requires authentication, the potential for internal network reconnaissance makes it a high-priority item for remediation in environments where the application has access to sensitive internal network segments.

Description Summary:
9router allows remote code execution via a chain of vulnerabilities involving default credentials, host header spoofing, and insecure command execution in the plugin registration process.

Executive Summary:
A critical vulnerability in 9router allows unauthenticated remote attackers to achieve full system compromise through a chain of exploits.

Vulnerability Details

CVE-ID: CVE-2026-63732

Affected Software: decolua 9router

Affected Versions: 0 up to (excluding) 0.4.60

Vulnerability: The software suffers from improper neutralization of special elements used in OS commands (CWE-78). By exploiting a hardcoded default credential to gain access, an attacker can bypass network restrictions and inject malicious payloads into child processes to execute arbitrary commands on the host.

Business Impact

The potential for unauthenticated remote code execution represents the highest level of security risk. Successful exploitation could lead to full system takeover, unauthorized access to sensitive data, and complete loss of control over the infrastructure. Given the CVSS score of 9.9, the impact on availability, integrity, and confidentiality is total.

Remediation Plan

Immediate Action: Update decolua 9router to version 0.4.60 or later immediately to resolve the command injection and credential flaws.

Proactive Monitoring: Audit system logs for unexpected child processes or unusual plugin registration activity.

Compensating Controls: Ensure the 9router instance is not exposed to the public internet and restrict access to authorized management networks only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of Jul 23, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of hardcoded credentials makes this software exceptionally easy to target if left exposed.

Analyst Recommendation

This vulnerability is severe and requires immediate attention. Administrators must prioritize updating to the patched version, as the combination of default credentials and command injection creates a trivial path for attackers to gain full control of the host operating system.

Description Summary:
The decolua 9router application contains a Server-Side Request Forgery (SSRF) vulnerability in its v1 web fetch functionality.

Executive Summary:
A Server-Side Request Forgery vulnerability in the decolua 9router application allows authenticated users to trigger unauthorized requests to internal or external resources.

Vulnerability Details

CVE-ID: CVE-2026-63313

Affected Software: decolua 9router

Affected Versions: Versions prior to 0.4.72

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability occurring within the v1 web fetch module, which can be leveraged by an authenticated user to force the server to make unintended network requests.

Business Impact

An SSRF vulnerability allows an attacker to bypass firewalls or network access control lists by using the vulnerable server as a proxy to reach internal services that are not exposed to the public internet. This can lead to the exposure of internal metadata services, unauthorized access to internal APIs, or the discovery of private network infrastructure. The CVSS score of 7.7 highlights the potential for significant internal network reconnaissance and subsequent compromise.

Remediation Plan

Immediate Action: Update the 9router application to version 0.4.72 or later.

Proactive Monitoring: Monitor outgoing network traffic from the server hosting 9router for unusual requests directed toward internal IP ranges or sensitive internal services.

Compensating Controls: Configure the server's network access controls to limit its ability to initiate outbound connections to sensitive internal segments or the public internet.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 24, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly dependent on the network architecture and the services reachable from the vulnerable host.

Analyst Recommendation

Upgrade to version 0.4.72 immediately to resolve the SSRF flaw. Security teams should also evaluate the network exposure of any server running 9router and implement strict egress filtering to minimize the impact of potential future SSRF-style vulnerabilities.

Description Summary:
9Router is vulnerable to unauthenticated information disclosure through API usage endpoints, resulting from missing authorization and improper exposure of sensitive data.

Executive Summary:
An unauthenticated information disclosure vulnerability in 9Router allows unauthorized access to sensitive private data via API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-62328

Affected Software: decolua 9Router

Affected Versions: 0 through 0.4.41

Vulnerability: This vulnerability stems from missing authorization checks, which allows an unauthenticated attacker to access private personal information via API usage endpoints.

Business Impact

The CVSS score of 7.5 reflects the high risk posed by unauthenticated access to sensitive data. A successful exploit could lead to a significant data breach, compromising user privacy and potentially violating regulatory compliance requirements regarding data protection.

Remediation Plan

Immediate Action: Upgrade to a version beyond 0.4.41 as soon as the vendor provides a security update, or apply the latest available version if a fix has been integrated.

Proactive Monitoring: Review API access logs for unauthorized requests or suspicious patterns targeting usage endpoints to identify potential reconnaissance or exploitation attempts.

Compensating Controls: Implement strict network-level access controls or API gateway authentication to restrict access to sensitive endpoints until a permanent software patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The nature of the flaw, specifically missing authorization on API endpoints, makes it a critical target for automated scanning tools.

Analyst Recommendation

Given the ease of exploitation for unauthenticated API vulnerabilities, organizations utilizing 9Router should treat this as a high-priority item. Immediate steps to restrict network access to the affected API endpoints are recommended until the vendor releases a formal security patch.

Description Summary:
The decolua 9Router /api/usage/stats endpoint lacks authentication, allowing unauthenticated attackers to retrieve plaintext API keys for connected AI accounts.

Executive Summary:
A critical unauthenticated information disclosure flaw in decolua 9Router allows attackers to steal sensitive AI provider API keys.

Vulnerability Details

CVE-ID: CVE-2026-62327

Affected Software: decolua 9Router

Affected Versions: decolua 9Router: 0 through 0.4.41

Vulnerability: This is a combination of missing authentication for critical functions (CWE-306) and insufficiently protected credentials (CWE-522). The application exposes sensitive API strings and usage metadata via an unauthenticated API route.

Business Impact

Exploitation allows attackers to hijack third-party AI provider accounts, leading to unauthorized usage, billing fraud, and potential exhaustion of usage quotas. Given the CVSS score of 9.1, the financial and operational impact to organizations relying on these integrations is high.

Remediation Plan

Immediate Action: Update decolua 9Router to the latest version (post-0.4.41) as specified by the vendor advisory.

Proactive Monitoring: Monitor API logs for unusual access patterns to the /api/usage/stats endpoint and check AI provider dashboards for anomalous usage spikes.

Compensating Controls: Revoke and rotate all existing AI provider API keys currently managed by the 9Router software as a precautionary measure.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is trivial to exploit as it requires only a single unauthenticated HTTP request.

Analyst Recommendation

Due to the ease of exploitation and the high impact of credential theft, users must update their 9Router instances immediately. Furthermore, all API keys stored within the application should be considered compromised and must be rotated following the update.

Description Summary:
An OS command injection vulnerability in decolua 9router versions before 0.5.2 allows authenticated attackers to execute arbitrary system commands.

Executive Summary:
An OS command injection vulnerability in decolua 9router before version 0.5.2 allows authenticated attackers to achieve remote code execution on the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-62312

Affected Software: decolua 9router

Affected Versions: < 0.5.2

Vulnerability: The application improperly neutralizes special elements used in OS commands. This vulnerability allows an authenticated attacker to inject and execute arbitrary system commands on the server hosting the 9router service.

Business Impact

Command injection is a severe vulnerability that grants an attacker the ability to execute code with the privileges of the application service. This can lead to full system takeover, data exfiltration, and the installation of persistent malware or backdoors, justifying the high CVSS score of 8.8.

Remediation Plan

Immediate Action: Upgrade to 9router version 0.5.2 or later to mitigate the command injection flaw.

Proactive Monitoring: Monitor server logs for unexpected process execution or abnormal system calls originating from the 9router application process.

Compensating Controls: Isolate the application within a containerized environment with restricted system privileges to limit the impact of potential command execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly critical due to the potential for arbitrary code execution.

Analyst Recommendation

Immediate update to version 0.5.2 is mandatory to secure the 9router instance against command injection. Security teams should verify that the application is running with the minimum necessary system privileges to reduce the blast radius of any potential compromise.

Description Summary:
A missing authentication vulnerability in decolua 9Router allows unauthenticated remote attackers to interact with management API endpoints.

Executive Summary:
Unauthenticated access to 9Router API endpoints allows remote attackers to manipulate provider connections, potentially exposing credentials and hijacking traffic.

Vulnerability Details

CVE-ID: CVE-2026-59801

Affected Software: decolua 9Router

Affected Versions: 0 through 0.4.41

Vulnerability: The application lacks necessary authentication middleware in its Next.js API routes, specifically under src/app/api/providers/. This flaw (CWE-306) allows any unauthenticated user to perform administrative actions, including the deletion of connections or redirection of traffic.

Business Impact

The ability to manipulate provider connections carries severe business consequences, including the theft of sensitive API keys and OAuth tokens. By redirecting AI traffic, attackers can intercept proprietary data or disrupt service operations, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the 9Router instance to a version beyond 0.4.41 as soon as a patch is released by the vendor.

Proactive Monitoring: Review API access logs for unauthorized requests to the /api/providers/ endpoint, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Implement network-level access controls to restrict access to the API endpoints to authorized IP addresses only until the software is updated.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's nature as an API design oversight makes it highly exploitable once identified.

Analyst Recommendation

This vulnerability presents a high risk to data confidentiality and integrity. Organizations utilizing 9Router should treat this as a high-priority item, ensuring that management interfaces are not exposed to the public internet and that the software is updated immediately upon the availability of a fix.

Description Summary:
9Router contains an OS command injection vulnerability in an unauthenticated API endpoint, allowing remote attackers to execute arbitrary system commands as root.

Executive Summary:
A critical OS command injection vulnerability in 9Router allows remote, unauthenticated attackers to achieve full system compromise via arbitrary command execution.

Vulnerability Details

CVE-ID: CVE-2026-59800

Affected Software: decolua 9router

Affected Versions: 0 up to (excluding) 0.4.44

Vulnerability: The /api/tunnel/tailscale-install endpoint fails to authenticate requests and improperly sanitizes the sudoPassword input, which is passed directly to a shell process, enabling command injection.

Business Impact

The CVSS score of 9.8 reflects the high risk of this vulnerability, which allows an attacker to execute commands with root privileges. Successful exploitation can lead to total system takeover, lateral movement within the network, and the exfiltration of sensitive configuration or user data. Confirmed exploitation in the wild further elevates the urgency of this advisory.

Remediation Plan

Immediate Action: Update 9router to version 0.4.44 or later immediately to patch the affected API endpoint.

Proactive Monitoring: Inspect system logs for suspicious process spawning, particularly those involving sudo or shell execution triggered by the web service, as exploitation has been observed in the wild.

Compensating Controls: Restrict network access to the 9Router management interface and associated API endpoints to authorized IP addresses only via network-level firewalls.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 7, 2026, exploitation of this vulnerability has been observed in the wild by the Shadowserver Foundation. Immediate patching is mandatory to secure the environment against active threats.

Analyst Recommendation

Given the confirmed active exploitation of this flaw, this issue should be treated with the highest level of urgency. Organizations running 9Router must apply the vendor-provided update immediately to neutralize this critical command injection risk.

Description Summary:
A vulnerability exists in decolua 9router allowing improper control of dynamically determined object attributes, which may lead to unauthorized data modification.

Executive Summary:
A vulnerability in decolua 9router allows authenticated attackers to perform unauthorized modification of object attributes, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-56679

Affected Software: decolua 9router

Affected Versions: < 0.5.4

Vulnerability: This flaw involves Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915). An authenticated attacker can exploit this to manipulate internal application attributes, which may result in unauthorized privilege escalation or data corruption.

Business Impact

The vulnerability carries a CVSS score of 8.7, reflecting a high severity level. Successful exploitation allows an attacker to manipulate core application logic, potentially leading to unauthorized access to sensitive information or the compromise of administrative functions. This could result in significant operational disruption and loss of data confidentiality.

Remediation Plan

Immediate Action: Update decolua 9router to version 0.5.4 or later to address the attribute modification flaw.

Proactive Monitoring: Review system access logs for unusual administrative activity or unexpected changes to application object states.

Compensating Controls: Ensure that access control policies are strictly enforced and limit the capabilities of authenticated users to the minimum necessary for their roles.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is tied to the ability of a user to interact with the application's dynamic object attributes.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize the deployment of the 0.5.4 update. Failure to patch this vulnerability leaves the application logic susceptible to manipulation by authenticated users, which could lead to severe security compromises.

Description Summary:
The decolua 9router AI router application is susceptible to missing authentication for critical functions and server-side request forgery, allowing unauthenticated remote attackers to interact with the system.

Executive Summary:
The decolua 9router application contains critical authentication bypass and server-side request forgery vulnerabilities that expose the system to unauthenticated remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-56677

Affected Software: decolua 9router

Affected Versions: <= 0.5.4

Vulnerability: This vulnerability involves missing authentication checks on critical functions and flaws in how the application processes external requests. An unauthenticated attacker can leverage these weaknesses to perform unauthorized actions or interact with internal services on behalf of the router.

Business Impact

This vulnerability carries a high CVSS score of 8.6, reflecting the ability for unauthenticated actors to manipulate the router's core functions. Successful exploitation could lead to data exfiltration, unauthorized token usage, or the use of the router as a proxy to attack internal infrastructure, resulting in a breach of confidentiality and integrity.

Remediation Plan

Immediate Action: Review the official security advisory at the decolua GitHub repository for available patches and apply them immediately upon release.

Proactive Monitoring: Monitor network traffic for unusual outbound requests originating from the 9router instance to internal or sensitive external endpoints.

Compensating Controls: Restrict network access to the 9router management interface to trusted IP addresses only, and utilize a Web Application Firewall to filter malicious or unexpected HTTP requests.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of missing authentication and SSRF makes this a high-priority target for automated exploitation.

Analyst Recommendation

Due to the lack of authentication required to exploit this software, immediate remediation is essential. Users should monitor the vendor's security advisory page closely and apply updates as soon as they are made available to protect the integrity of the router and connected AI services.

Description Summary:
The 9router AI router and token saver contains vulnerabilities involving TOCTOU race conditions and Server-Side Request Forgery (SSRF) that can be exploited by authenticated users.

Executive Summary:
9router contains race condition and SSRF vulnerabilities that could allow an authenticated user to perform unauthorized actions or pivot through the network.

Vulnerability Details

CVE-ID: CVE-2026-56676

Affected Software: decolua 9router

Affected Versions: < 0.5.2

Vulnerability: This vulnerability involves a Time-of-check Time-of-use (TOCTOU) race condition and Server-Side Request Forgery (SSRF) flaws. The attacker must have a low level of privileges to trigger these conditions, which can lead to unauthorized request execution or state manipulation within the software.

Business Impact

With a CVSS score of 7.4, this vulnerability poses a high risk to the confidentiality and integrity of the AI routing infrastructure. A successful exploit could allow an attacker to bypass security checks or use the router to perform requests against internal resources, potentially leading to unauthorized data access or service disruption.

Remediation Plan

Immediate Action: Update the 9router software to version 0.5.2 or later to include the necessary security fixes.

Proactive Monitoring: Review application and system logs for unexpected outbound requests originating from the 9router service that may indicate SSRF attempts.

Compensating Controls: Ensure that the 9router service is running with the least privilege necessary and use egress filtering to prevent the application from making unauthorized requests to internal network segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of specific fix commits in the upstream repository indicates that the patch is effective at resolving the race condition and SSRF pathways.

Analyst Recommendation

Users of the 9router software should update to version 0.5.2 immediately. Given the nature of SSRF and race condition flaws, rapid patching is essential to prevent internal network exploitation by authenticated actors.

Description Summary:
9Router contains multiple authentication vulnerabilities, including improper authentication and missing checks for critical functions, leading to potential bypass.

Executive Summary:
Authentication bypass vulnerabilities in 9Router versions prior to 0.5.2 permit unauthorized remote access to critical system functionality.

Vulnerability Details

CVE-ID: CVE-2026-56675

Affected Software: decolua 9router

Affected Versions: < 0.5.2

Vulnerability: This vulnerability stems from improper authentication and spoofing issues, where the system fails to verify the identity of the user before allowing access to critical operations. An unauthenticated attacker can effectively bypass security controls.

Business Impact

Exploitation of these authentication weaknesses could allow an attacker to bypass security mechanisms entirely, leading to unauthorized access to sensitive data or control of the application. The CVSS score of 8.3 indicates a high level of risk to the overall security posture of the affected system.

Remediation Plan

Immediate Action: Update the 9Router software to version 0.5.2 or higher to ensure robust authentication mechanisms are enforced.

Proactive Monitoring: Monitor for unusual login patterns or access to administrative functions from unexpected or unauthorized network sources.

Compensating Controls: Deploy strict network segmentation and ensure that access to the 9Router management interface is limited to authenticated, trusted internal users only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authentication bypass vulnerabilities are severe and necessitate immediate remediation. Ensure all instances of 9Router are updated to version 0.5.2 to mitigate the risk of unauthorized access and maintain the integrity of your authentication infrastructure.

Description Summary:
9Router is vulnerable to multiple security flaws, including authentication bypass and server-side request forgery (SSRF), allowing unauthenticated remote attackers to compromise the system.

Executive Summary:
The Decolua 9Router AI tool is affected by critical vulnerabilities, including authentication bypass and SSRF, which could allow an unauthenticated attacker to gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-55641

Affected Software: Decolua 9Router

Affected Versions: < 0.5.2

Vulnerability: This vulnerability consists of an authentication bypass via spoofing and a Server-Side Request Forgery (SSRF) flaw, which can be triggered by an unauthenticated remote attacker with low complexity.

Business Impact

Successful exploitation of these vulnerabilities allows for unauthorized access to internal resources and potential information disclosure. With a CVSS score of 8.2, this high-severity flaw poses a significant risk to the integrity and confidentiality of the host environment and any connected AI token services.

Remediation Plan

Immediate Action: Upgrade to version 0.5.2 or later immediately to resolve the identified security weaknesses.

Proactive Monitoring: Monitor network traffic for unexpected outbound requests originating from the 9Router instance, which may indicate active SSRF exploitation.

Compensating Controls: Implement strict egress filtering on the host machine to prevent the software from making unauthorized connections to internal or sensitive external services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The combination of authentication bypass and SSRF presents a severe risk to any environment hosting 9Router. Administrators must prioritize updating to version 0.5.2 to eliminate these vectors and prevent potential unauthorized access to sensitive system data.

Description Summary:
9Router is affected by missing and incorrect authorization vulnerabilities, enabling unauthorized access to critical functions.

Executive Summary:
Missing and incorrect authorization flaws in 9Router versions prior to 0.5.2 expose the system to unauthorized access and potential service disruption.

Vulnerability Details

CVE-ID: CVE-2026-55638

Affected Software: decolua 9router

Affected Versions: < 0.5.2

Vulnerability: The software fails to properly implement authorization checks, allowing an unauthenticated remote attacker to gain unauthorized access to protected functions or manipulate system state.

Business Impact

This vulnerability allows unauthenticated users to perform actions that should be restricted, potentially leading to unauthorized data access or service disruption. With a CVSS score of 8.6, the vulnerability represents a significant risk to the integrity and availability of the 9Router deployment.

Remediation Plan

Immediate Action: Upgrade to 9Router version 0.5.2 or later to resolve the authorization logic flaws.

Proactive Monitoring: Review application logs for unauthorized attempts to access restricted API endpoints or administrative routes.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out suspicious requests and enforce access control policies at the network edge.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of authorization vulnerabilities in a router/token saver product is critical. Administrators should apply the 0.5.2 update immediately to restore proper access controls and prevent unauthorized manipulation of the service.

Description Summary:
9router fails to properly restrict excessive authentication attempts, potentially allowing attackers to conduct brute-force or credential-stuffing attacks against the system.

Executive Summary:
An improper restriction of authentication attempts in 9router could allow an unauthenticated attacker to brute-force system credentials.

Vulnerability Details

CVE-ID: CVE-2026-55501

Affected Software: decolua 9router

Affected Versions: < 0.4.80

Vulnerability: The application lacks adequate mechanisms to limit the rate or number of authentication attempts (CWE-307). This allows an unauthenticated attacker to submit repeated login attempts, significantly increasing the likelihood of successfully guessing valid credentials.

Business Impact

The CVSS score of 7.3 reflects the high risk of account takeover via brute-force. Successful exploitation could lead to full unauthorized access to the router’s administrative functions, potentially resulting in complete compromise of the routing data and the AI token-saving configuration.

Remediation Plan

Immediate Action: Update the 9router package to version 0.4.77 or later to implement the required authentication rate limiting.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts from single or distributed IP addresses.

Compensating Controls: Implement an external rate-limiting mechanism, such as an identity-aware proxy or a Web Application Firewall (WAF) rule, to block IPs showing suspicious authentication activity.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly automatable, which increases the necessity for defensive measures.

Analyst Recommendation

The availability of a proof-of-concept and the lack of native rate limiting make this a priority for remediation. Organizations should update to the patched version immediately to prevent automated credential-guessing attacks.

Description Summary:
The 9Router /api/settings/database endpoint allows unauthorized database export and import due to insufficient authentication checks.

Executive Summary:
A critical authentication bypass in decolua 9Router allows unauthorized actors to fully export or overwrite the application database, leading to potential credential and token theft.

Vulnerability Details

CVE-ID: CVE-2026-55500

Affected Software: decolua 9router

Affected Versions: < 0.4.80

Vulnerability: The /api/settings/database endpoint fails to properly validate authentication for database operations. While the middleware checks for tokens, the implementation is insufficient, allowing authenticated users to perform unauthorized full database exports or imports.

Business Impact

The exposure of the entire database, including API keys, OAuth tokens, and sensitive credentials, poses an existential threat to the security of the infrastructure managed by 9Router. A CVSS score of 9.9 confirms the catastrophic potential of this vulnerability, as it allows for full data exfiltration and persistent system manipulation.

Remediation Plan

Immediate Action: Update to version 0.4.80 or later to implement the corrected authentication middleware.

Proactive Monitoring: Audit database access logs for unauthorized export or modification requests occurring outside of standard administrative workflows.

Compensating Controls: Restrict network access to the /api/settings/database endpoint via a Web Application Firewall (WAF) or internal network segmentation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability is of the highest severity and requires urgent attention. Administrators must verify that the update to 0.4.80 is applied immediately to prevent the leakage of sensitive credentials and the total takeover of the routing infrastructure.

Description Summary:
9Router contains a hardcoded fallback JWT secret in its authentication routing and middleware, allowing unauthenticated attackers to forge authentication tokens.

Executive Summary:
A hardcoded authentication secret in the decolua 9router package allows unauthenticated attackers to bypass security controls and forge administrative tokens.

Vulnerability Details

CVE-ID: CVE-2026-49352

Affected Software: decolua 9router

Affected Versions: 0.2.21 up to 0.4.44

Vulnerability: This vulnerability involves the use of a hardcoded fallback JWT secret (9router-default-secret-change-me) within the application authentication logic. Because the vulnerability is present in the login routing and middleware, unauthenticated attackers can successfully forge authentication cookies if the primary JWT_SECRET environment variable is not explicitly set.

Business Impact

The ability to forge authentication tokens grants an attacker complete unauthorized access to the application, effectively bypassing all authentication and authorization mechanisms. Given the CVSS score of 9.8, this represents a critical risk that could lead to full system compromise, data exfiltration, or administrative account takeover, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Update the decolua 9router package to version 0.4.44 or later immediately.

Proactive Monitoring: Review authentication logs for suspicious login patterns or unauthorized access attempts using unexpected session tokens.

Compensating Controls: Ensure the JWT_SECRET environment variable is explicitly and securely configured for all deployments to prevent the application from falling back to the hardcoded default.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub.

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept repository is available, which significantly lowers the barrier for potential attackers. The presence of a hardcoded credential in a critical authentication path makes this vulnerability highly susceptible to automated exploitation.

Analyst Recommendation

This is a critical security flaw that requires immediate attention. Organizations utilizing decolua 9router must upgrade to version 0.4.44 without delay to remove the hardcoded secret. Failure to patch will leave the authentication layer entirely exposed to trivial token forgery attacks.

Description Summary:
9Router contains an authentication bypass vulnerability allowing unauthenticated remote command execution via unprotected API endpoints.

Executive Summary:
The 9Router AI router software is affected by a critical vulnerability that permits unauthenticated attackers to execute arbitrary system commands, leading to full remote control.

Vulnerability Details

CVE-ID: CVE-2026-46339

Affected Software: decolua 9router

Affected Versions: 0.4.30 through 0.4.36

Vulnerability: This vulnerability involves missing authentication checks in the middleware for specific API routes, which allows an unauthenticated attacker to perform command injection via the MCP bridge or register custom plugins.

Business Impact

Successful exploitation of this flaw grants an attacker full command execution capabilities on the host system. Given the CVSS score of 10.0, this represents a maximum severity risk that could result in total system compromise, data exfiltration, or the deployment of persistent malware within the network environment.

Remediation Plan

Immediate Action: Update the 9router installation to version 0.4.37 or later immediately to resolve the authentication and command injection vulnerabilities.

Proactive Monitoring: Monitor system logs for unauthorized API requests targeting the /api/cli-tools/ or /api/mcp/ endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access to the affected API paths until the update can be applied.

Exploitation Status

Public Exploit Available: No (only a Nuclei detection template exists).

Analyst Notes: As of July 15, 2026, there is no public information indicating active exploitation or a functional weaponized exploit for this vulnerability. The presence of a Nuclei template facilitates automated vulnerability scanning rather than direct exploitation.

Analyst Recommendation

This vulnerability presents a critical threat due to the ease of access and the severity of impact. Administrators must prioritize updating to version 0.4.37 immediately to prevent unauthorized remote command execution.