Executive brief
9router, a tool for managing AI model traffic and plugins, contains a critical security flaw that allows unauthorized remote access. By using a known default password and tricking the system into thinking a request is coming from the local machine, an attacker can take full control of the server. This could lead to the theft of sensitive AI API keys, interception of private data, and complete compromise of the underlying host system.
Technical details
A vulnerability chain in 9router < 0.4.60 allows for remote code execution. First, fresh installations use a hardcoded default password ('123456') in the login route. Second, the 'isLocalRequest' middleware incorrectly trusts the client-supplied Host header to verify local-only access, allowing remote attackers to reach restricted routes like /api/cli-tools/cowork-settings by spoofing 'Host: localhost'. Third, the MCP plugin registration fails to validate arguments passed to child_process.spawn(). An attacker can register a malicious plugin using the 'node' command with '-e' arguments and trigger execution via the plugin's SSE endpoint. This results in arbitrary OS command execution as the process user (often root in Docker environments).
Affected products
- decolua 9router < 0.4.60
Timeline
- 2026-07-03: advisory: Vendor advisory GHSA-4922-8r65-fq26 published
- 2026-07-23: disclosed: CVE-2026-63732 published to NVD