CVE-2026-56678

MEDIUM

9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding

Title source: cna
STIX 2.1

Description

9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.

References (3)

Core 3

Scores

CVSS v3 6.4
EPSS 0.0017
EPSS Percentile 6.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-20 CWE-918
Status published
Products (1)
decolua/9router < 0.5.6
Published Jul 15, 2026
Tracked Since Jul 16, 2026