Is CVE-2026-10269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10269 being exploited in the wild.

How severe is CVE-2026-10269?

Medium severity, with a CVSS score of 6.3, published 1 June 2026.

Is there a fix for CVE-2026-10269?

A patch was published on 2026-04-23: Version 0.4.1 released with security hardening Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10269 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10269?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10269: decolua 9router improper authorization in dashboardGuard.js

CVE-2026-10269 · Severity: medium · CVSS 6.3 · Published 2026-06-01

decolua 9router is an AI routing tool used to manage and optimize connections to various AI model providers. A security flaw in the dashboard's authentication logic allows remote attackers to bypass security checks by manipulating network headers. This could lead to unauthorized access to sensitive internal data, including API keys and system settings, potentially compromising the integrity of the AI services being managed.

Quick answers

Is CVE-2026-10269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10269 being exploited in the wild.
How severe is CVE-2026-10269?: Medium severity, with a CVSS score of 6.3, published 1 June 2026.
Which products and versions are affected?: decolua 9router up to 0.4.0.
Is there a fix for CVE-2026-10269?: A patch was published on 2026-04-23: Version 0.4.1 released with security hardening Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10269 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10269?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authorization vulnerability exists in decolua 9router versions up to 0.4.0 within the `isAuthenticated` function of `src/dashboardGuard.js`. The root cause is a logic flaw where the application relies on the user-controllable HTTP 'Host' header to determine if a request is coming from a trusted local source. A remote attacker with low privileges can manipulate this header to bypass the dashboard's authentication mechanisms. Successful exploitation grants unauthorized access to sensitive internal API endpoints such as `/api/keys` and `/api/settings`. The issue is further exacerbated by a Next.js middleware misconfiguration that failed to properly enforce security guards. This has been addressed in version 0.4.1 by implementing stricter CLI token validation and correcting the middleware configuration.

Affected products

decolua 9router up to 0.4.0

Timeline

2026-04-23: disclosed: Issue reported on GitHub and patch released
2026-04-23: patched: Version 0.4.1 released with security hardening
2026-06-01: advisory: CVE-2026-10269 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.