Is CVE-2026-62327 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62327 being exploited in the wild.

How severe is CVE-2026-62327?

Critical severity, with a CVSS score of 9.1, published 13 July 2026.

Is there a fix for CVE-2026-62327?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-62327 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-62327?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62327: decolua 9Router missing authentication in API endpoints

CVE-2026-62327 · Severity: critical · CVSS 9.1 · Published 2026-07-13

9Router, an AI model routing dashboard, contains a critical security flaw where several administrative interfaces are accessible without a password. An attacker can remotely access the system to steal plaintext API keys for AI providers (like OpenAI), view private conversation histories between users and AI models, and modify or delete service connections. This could lead to significant financial loss through billing fraud, the theft of sensitive corporate data contained in AI prompts, and a total shutdown of AI-dependent services.

Quick answers

Is CVE-2026-62327 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62327 being exploited in the wild.
How severe is CVE-2026-62327?: Critical severity, with a CVSS score of 9.1, published 13 July 2026.
Which products and versions are affected?: decolua 9Router <= 0.4.41.
Is there a fix for CVE-2026-62327?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-62327 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-62327?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

9Router suffers from missing authentication middleware across several Next.js API routes, specifically under the /api/providers/* and /api/usage/* paths. A remote, unauthenticated attacker can send simple GET requests to /api/usage/stats to retrieve plaintext API keys for all configured AI providers, or to /api/usage/request-details/:id to view full conversation turns including system prompts and user messages. Furthermore, the /api/providers endpoint lacks authorization for POST, PUT, and DELETE methods, allowing attackers to hijack traffic by injecting malicious provider proxies or delete existing configurations to cause a denial of service. As of the advisory date, no official patch has been released, though developers are advised to implement authentication middleware and mask sensitive credentials in API responses.

Affected products

decolua 9Router <= 0.4.41

Timeline

2026-06-13: advisory: Vendor advisory GHSA-vjc7-jrh9-9j86 published
2026-07-13: disclosed: CVE-2026-62327 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.