Vulnerability-Lookup

CVE-2026-49353 (GCVE-0-2026-49353)

Vulnerability from cvelistv5 – Published: 2026-07-15 20:49 – Updated: 2026-07-16 15:12

Title

9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

Summary

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/decolua/9router/security/advis…	x_refsource_CONFIRM
https://github.com/decolua/9router/commit/5e1c126…	x_refsource_MISC
https://github.com/decolua/9router/commit/bb86808…	x_refsource_MISC
https://github.com/decolua/9router/releases/tag/v0.4.46	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
decolua	9router	Affected: <= 0.4.45

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-49353",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-16T14:49:42.771907Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-16T15:12:31.230Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.4.45"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "9Router is an AI router \u0026 token saver. In 0.4.45 and earlier, 9Router\u0027s src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T20:49:15.693Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf"
        },
        {
          "name": "https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db"
        },
        {
          "name": "https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5"
        },
        {
          "name": "https://github.com/decolua/9router/releases/tag/v0.4.46",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/decolua/9router/releases/tag/v0.4.46"
        }
      ],
      "source": {
        "advisory": "GHSA-6g2f-w7g3-77vf",
        "discovery": "UNKNOWN"
      },
      "title": "9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-49353",
    "datePublished": "2026-07-15T20:49:15.693Z",
    "dateReserved": "2026-05-29T14:35:45.903Z",
    "dateUpdated": "2026-07-16T15:12:31.230Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-49353",
      "date": "2026-07-16",
      "epss": "0.00357",
      "percentile": "0.27928"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-49353\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-07-15T21:16:53.870\",\"lastModified\":\"2026-07-16T16:19:10.110\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"9Router is an AI router \u0026 token saver. In 0.4.45 and earlier, 9Router\u0027s src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"decolua\",\"product\":\"9router\",\"versions\":[{\"version\":\"\u003c= 0.4.45\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":4.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-07-16T14:49:42.771907Z\",\"id\":\"CVE-2026-49353\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-290\"}]}],\"references\":[{\"url\":\"https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/releases/tag/v0.4.46\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-49353\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-16T14:49:42.771907Z\"}}}], \"references\": [{\"url\": \"https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-16T14:49:51.029Z\"}}], \"cna\": {\"title\": \"9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING\", \"source\": {\"advisory\": \"GHSA-6g2f-w7g3-77vf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"decolua\", \"product\": \"9router\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 0.4.45\"}]}], \"references\": [{\"url\": \"https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf\", \"name\": \"https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db\", \"name\": \"https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5\", \"name\": \"https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/decolua/9router/releases/tag/v0.4.46\", \"name\": \"https://github.com/decolua/9router/releases/tag/v0.4.46\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"9Router is an AI router \u0026 token saver. In 0.4.45 and earlier, 9Router\u0027s src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290: Authentication Bypass by Spoofing\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-07-15T20:49:15.693Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-49353\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-16T15:12:31.230Z\", \"dateReserved\": \"2026-05-29T14:35:45.903Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-07-15T20:49:15.693Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-49353

Vulnerability from fkie_nvd - Published: 2026-07-15 21:16 - Updated: 2026-07-16 16:19

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db
	security-advisories@github.com	https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5
	security-advisories@github.com	https://github.com/decolua/9router/releases/tag/v0.4.46
	security-advisories@github.com	https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.4.45"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "9Router is an AI router \u0026 token saver. In 0.4.45 and earlier, 9Router\u0027s src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths."
    }
  ],
  "id": "CVE-2026-49353",
  "lastModified": "2026-07-16T16:19:10.110",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49353",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-16T14:49:42.771907Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-15T21:16:53.870",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/releases/tag/v0.4.46"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-6G2F-W7G3-77VF

Vulnerability from github – Published: 2026-07-02 21:13 – Updated: 2026-07-02 21:13

Summary

9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

Details

Summary

The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in src/dashboardGuard.js that restricts spawn-capable routes (/api/mcp/*, /api/tunnel/*, /api/cli-tools/*) to loopback requests. The gate determines "local" by inspecting the Host and Origin HTTP headers rather than the TCP source address. When 9router is deployed behind a reverse proxy, tunnel (Cloudflare Tunnel, Tailscale — both natively supported), or is subject to DNS rebinding, these headers are attacker-controlled, allowing the local-only gate to be bypassed.

A second factor (CLI token or JWT cookie) is required by canAccessLocalOnlyRoute(), but the CLI token is a deterministic HMAC of the machine ID (getConsistentMachineId), which is stable and predictable on cloud VMs. If the attacker can obtain or guess the machine ID (e.g., via another information disclosure, or on shared-tenant infrastructure), the full chain to MCP child process stdin injection is reachable.

This is a variant / incomplete fix of CVE-2026-46339 — the same attack surface (remote → MCP child process stdin) remains reachable under specific but realistic deployment configurations.

Root Cause

isLocalRequest() at src/dashboardGuard.js:93-101:

function isLocalRequest(request) {
  if (!isLoopbackHostname(request.headers.get("host"))) return false;
  const origin = request.headers.get("origin");
  if (origin) {
    try {
      if (!isLoopbackHostname(new URL(origin).hostname)) return false;
    } catch { return false; }
  }
  return true;
}

This function trusts Host and Origin headers as proof of local origin. Both are attacker-controlled in any proxied deployment. The LOOPBACK_HOSTS set (localhost, 127.0.0.1, ::1) is checked against these headers, not against the actual connection source IP.

Attack Scenario

Scenario 1: Cloudflare Tunnel / Tailscale Funnel

9router natively supports Cloudflare Tunnel and Tailscale (see LOCAL_ONLY_PATHS entries for /api/tunnel/*). When exposed via tunnel:

Attacker sends request to https://<tunnel-domain>/api/mcp/<plugin>/sse
Sets Host: localhost:3000 and Origin: http://localhost:3000
isLocalRequest() returns true
canAccessLocalOnlyRoute() then requires CLI token or (local + JWT)
CLI token is getConsistentMachineId("9r-cli-auth") — a deterministic HMAC of the machine's hardware/OS identifiers

Scenario 2: DNS Rebinding

Attacker controls evil.com DNS, initially resolving to attacker IP
Victim's browser navigates to evil.com (or via iframe/redirect)
DNS rebinding switches evil.com → 127.0.0.1
Subsequent fetch to evil.com:3000/api/mcp/<plugin>/message reaches 9router
Host header is evil.com:3000 — this is blocked by the current check (not in LOOPBACK_HOSTS)
However, if the attacker uses localhost:3000 as the request host via CORS or service worker tricks, and the browser sends Host: localhost:3000, the gate opens

Exploitation (when CLI token is obtained)

Once past the gate, the attacker can:

GET /api/mcp/<plugin>/sse — establish SSE session, get sessionId
POST /api/mcp/<plugin>/message — send arbitrary JSON-RPC to the child process stdin
The child process is one of: npx, node, python, python3, uvx, bunx, bun
Depending on the MCP plugin implementation, this can achieve arbitrary code execution on the host

Steps to Reproduce

Deploy 9router behind a reverse proxy or tunnel
From a remote host, send:

GET /api/mcp/browser/sse HTTP/1.1
Host: localhost:3000
Origin: http://localhost:3000
x-9r-cli-token: <machine-id-derived-token>

Observe: SSE connection established, endpoint event received with message URL
POST arbitrary JSON-RPC to the message endpoint

Impact

An attacker who can reach a proxied/tunneled 9router instance and obtain the deterministic CLI token can bypass the local-only restriction and interact with MCP child processes (node, python, npx, etc.) via stdin. This achieves the same impact as CVE-2026-46339: remote code execution on the host.

The severity is reduced from CVE-2026-46339's CVSS 10.0 because: - Requires proxied/tunneled deployment (not default localhost-only) - Requires obtaining the CLI token (deterministic but not trivially guessable without another primitive)

Remediation

Check actual source IP, not headers. Use request.ip, request.socket.remoteAddress, or a trusted X-Forwarded-For header with known proxy configuration instead of Host/Origin for the local-only gate.
Make CLI token non-deterministic. Generate a random token on first run and persist it, rather than deriving from machine ID. Machine IDs are often predictable or discoverable on cloud infrastructure.
Bind MCP routes to loopback at the network layer. If MCP is local-only by design, the server should bind those routes to 127.0.0.1 only, not rely on middleware header checks.

Credit: @snailsploit

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "9router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.4.55"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49353"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-290"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T21:13:19Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in `src/dashboardGuard.js` that restricts spawn-capable routes (`/api/mcp/*`, `/api/tunnel/*`, `/api/cli-tools/*`) to loopback requests. The gate determines \"local\" by inspecting the `Host` and `Origin` HTTP headers rather than the TCP source address. When 9router is deployed behind a reverse proxy, tunnel (Cloudflare Tunnel, Tailscale \u2014 both natively supported), or is subject to DNS rebinding, these headers are attacker-controlled, allowing the local-only gate to be bypassed.\n\nA second factor (CLI token or JWT cookie) is required by `canAccessLocalOnlyRoute()`, but the CLI token is a deterministic HMAC of the machine ID (`getConsistentMachineId`), which is stable and predictable on cloud VMs. If the attacker can obtain or guess the machine ID (e.g., via another information disclosure, or on shared-tenant infrastructure), the full chain to MCP child process stdin injection is reachable.\n\nThis is a variant / incomplete fix of CVE-2026-46339 \u2014 the same attack surface (remote \u2192 MCP child process stdin) remains reachable under specific but realistic deployment configurations.\n\n## Root Cause\n\n`isLocalRequest()` at `src/dashboardGuard.js:93-101`:\n\n```javascript\nfunction isLocalRequest(request) {\n  if (!isLoopbackHostname(request.headers.get(\"host\"))) return false;\n  const origin = request.headers.get(\"origin\");\n  if (origin) {\n    try {\n      if (!isLoopbackHostname(new URL(origin).hostname)) return false;\n    } catch { return false; }\n  }\n  return true;\n}\n```\n\nThis function trusts `Host` and `Origin` headers as proof of local origin. Both are attacker-controlled in any proxied deployment. The `LOOPBACK_HOSTS` set (`localhost`, `127.0.0.1`, `::1`) is checked against these headers, not against the actual connection source IP.\n\n## Attack Scenario\n\n### Scenario 1: Cloudflare Tunnel / Tailscale Funnel\n\n9router natively supports Cloudflare Tunnel and Tailscale (see `LOCAL_ONLY_PATHS` entries for `/api/tunnel/*`). When exposed via tunnel:\n\n1. Attacker sends request to `https://\u003ctunnel-domain\u003e/api/mcp/\u003cplugin\u003e/sse`\n2. Sets `Host: localhost:3000` and `Origin: http://localhost:3000`\n3. `isLocalRequest()` returns `true`\n4. `canAccessLocalOnlyRoute()` then requires CLI token or (local + JWT)\n5. CLI token is `getConsistentMachineId(\"9r-cli-auth\")` \u2014 a deterministic HMAC of the machine\u0027s hardware/OS identifiers\n\n### Scenario 2: DNS Rebinding\n\n1. Attacker controls `evil.com` DNS, initially resolving to attacker IP\n2. Victim\u0027s browser navigates to `evil.com` (or via iframe/redirect)\n3. DNS rebinding switches `evil.com` \u2192 `127.0.0.1`\n4. Subsequent fetch to `evil.com:3000/api/mcp/\u003cplugin\u003e/message` reaches 9router\n5. `Host` header is `evil.com:3000` \u2014 this is **blocked** by the current check (not in LOOPBACK_HOSTS)\n6. However, if the attacker uses `localhost:3000` as the request host via CORS or service worker tricks, and the browser sends `Host: localhost:3000`, the gate opens\n\n### Exploitation (when CLI token is obtained)\n\nOnce past the gate, the attacker can:\n\n1. `GET /api/mcp/\u003cplugin\u003e/sse` \u2014 establish SSE session, get `sessionId`\n2. `POST /api/mcp/\u003cplugin\u003e/message` \u2014 send arbitrary JSON-RPC to the child process stdin\n3. The child process is one of: `npx`, `node`, `python`, `python3`, `uvx`, `bunx`, `bun`\n4. Depending on the MCP plugin implementation, this can achieve arbitrary code execution on the host\n\n## Steps to Reproduce\n\n1. Deploy 9router behind a reverse proxy or tunnel\n2. From a remote host, send:\n\n```http\nGET /api/mcp/browser/sse HTTP/1.1\nHost: localhost:3000\nOrigin: http://localhost:3000\nx-9r-cli-token: \u003cmachine-id-derived-token\u003e\n```\n\n3. Observe: SSE connection established, `endpoint` event received with message URL\n4. POST arbitrary JSON-RPC to the message endpoint\n\n## Impact\n\nAn attacker who can reach a proxied/tunneled 9router instance and obtain the deterministic CLI token can bypass the local-only restriction and interact with MCP child processes (node, python, npx, etc.) via stdin. This achieves the same impact as CVE-2026-46339: remote code execution on the host.\n\nThe severity is reduced from CVE-2026-46339\u0027s CVSS 10.0 because:\n- Requires proxied/tunneled deployment (not default localhost-only)\n- Requires obtaining the CLI token (deterministic but not trivially guessable without another primitive)\n\n## Remediation\n\n1. **Check actual source IP, not headers.** Use `request.ip`, `request.socket.remoteAddress`, or a trusted `X-Forwarded-For` header with known proxy configuration instead of `Host`/`Origin` for the local-only gate.\n\n2. **Make CLI token non-deterministic.** Generate a random token on first run and persist it, rather than deriving from machine ID. Machine IDs are often predictable or discoverable on cloud infrastructure.\n\n3. **Bind MCP routes to loopback at the network layer.** If MCP is local-only by design, the server should bind those routes to `127.0.0.1` only, not rely on middleware header checks.\n\n\nCredit: @snailsploit",
  "id": "GHSA-6g2f-w7g3-77vf",
  "modified": "2026-07-02T21:13:19Z",
  "published": "2026-07-02T21:13:19Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db"
    },
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decolua/9router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-49353 (GCVE-0-2026-49353)

FKIE_CVE-2026-49353

GHSA-6G2F-W7G3-77VF

Summary

Root Cause

Attack Scenario

Scenario 1: Cloudflare Tunnel / Tailscale Funnel

Scenario 2: DNS Rebinding

Exploitation (when CLI token is obtained)

Steps to Reproduce

Impact

Remediation

Tags

Sightings

Nomenclature