CVE-2026-49353

HIGH

9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING

Title source: cna
STIX 2.1

Description

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

References (4)

Core 4

Scores

CVSS v3 7.5
EPSS 0.0023
EPSS Percentile 14.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-290
Status published
Products (1)
decolua/9router <= 0.4.45
Published Jul 15, 2026
Tracked Since Jul 16, 2026