Executive brief
router-for-me CLIProxyAPI is a tool used for managing router interfaces via an API. A security vulnerability in its management interface allows an authenticated attacker to force the server to make unauthorized requests to internal or external web addresses. This could be used to scan internal networks, bypass firewalls, or access sensitive internal services that are not intended to be exposed to the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the 'internal/api/handlers/management/api_tools.go' component of router-for-me CLIProxyAPI version 6.9.29. The vulnerability stems from insufficient validation of the 'url' argument within the API interface; while the system checks if the URL is non-empty and contains a scheme/host, it fails to verify if the host belongs to a private IP range or a restricted domain. An attacker with a valid 'Authorization: Bearer' token can manipulate the 'url' parameter and HTTP methods (GET, POST, etc.) to proxy requests through the server. This can be exploited to perform internal port scanning or interact with internal network resources. As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- router-for-me CLIProxyAPI 6.9.29
Timeline
- 2026-05-07: disclosed: Public disclosure of the exploit details.
- 2026-05-07: advisory: Initial publication of CVE-2026-8081.