Is CVE-2026-59801 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59801 being exploited in the wild.

How severe is CVE-2026-59801?

Critical severity, with a CVSS score of 9.8, published 13 July 2026.

Which products and versions are affected?

9router (npm) SEMVER:introduced=0,last_affected=0.4.41.

Is there a fix for CVE-2026-59801?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-59801 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-59801?

Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59801: decolua 9Router missing authentication in management API

CVE-2026-59801 · Severity: critical · CVSS 9.8 · Published 2026-07-13

9Router, an AI model routing dashboard, contains a critical security flaw where several management interfaces are completely unprotected. An unauthorized person can access the system over the internet to steal sensitive AI provider API keys, view private conversation histories between users and AI models, or shut down the service entirely. This could lead to the theft of expensive AI resources or the exposure of confidential business data contained in AI prompts.

Technologies: 9router (npm). Vendors: npm.

Quick answers

Is CVE-2026-59801 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59801 being exploited in the wild.
How severe is CVE-2026-59801?: Critical severity, with a CVSS score of 9.8, published 13 July 2026.
Which products and versions are affected?: 9router (npm) SEMVER:introduced=0,last_affected=0.4.41.
Is there a fix for CVE-2026-59801?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59801 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-59801?: Check whether you run 9router (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from missing authentication middleware in several Next.js API routes, specifically under /api/providers/* and /api/usage/*. A remote, unauthenticated attacker can perform CRUD operations on provider connections, allowing them to inject malicious providers to intercept traffic or delete existing ones to cause a denial of service. Additionally, the /api/usage/stats endpoint leaks full plaintext API keys (e.g., OpenAI, Anthropic), and /api/usage/request-details exposes complete conversation logs including system prompts and assistant responses. As of the advisory date, no patched version has been released.

Affected products

decolua 9Router <= 0.4.41

Identifiers

CVE-2026-59801
GHSA-vjc7-jrh9-9j86

Timeline

2026-06-13: advisory: Initial GitHub Security Advisory published by vendor
2026-07-13: disclosed: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.