What’s Vulnerable › Products

decolua 9router vulnerabilities

26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 26 published in the last 12 months.

Check whether your decolua 9router version is affected

Latest decolua 9router vulnerabilities

• CVE-2026-108593 — 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint (CVSS 6.4)
• CVE-2026-103530 — decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery (CVSS 7.3)
• CVE-2026-56682 — 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header (CVSS 5.3)
• CVE-2026-56681 — 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header (CVSS 7.3)
• CVE-2026-72860 — 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable (CVSS 8.5)
• CVE-2026-56677 — 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint (CVSS 8.6)
• CVE-2026-63732 — 9router before 0.4.60 Remote Code Execution via default password (CVSS 9.9)
• CVE-2026-63313 — 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch (CVSS 7.7)
• CVE-2026-62312 — 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments (CVSS 8.8)
• CVE-2026-56679 — 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade (CVSS 8.7)
• CVE-2026-56678 — 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding (CVSS 6.4)
• CVE-2026-49353 — 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING (CVSS 7.5)
• CVE-2026-49352 — 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass (CVSS 9.8)
• CVE-2026-46339 — 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes (CVSS 10.0)
• CVE-2026-62328 — 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints (CVSS 7.5)
• CVE-2026-62327 — 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats (CVSS 9.1)
• CVE-2026-59801 — 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers (CVSS 9.8)
• CVE-2026-56675 — 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs (CVSS 8.3)
• CVE-2026-55641 — 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF (CVSS 8.2)
• CVE-2026-55638 — 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass (CVSS 8.6)
• CVE-2026-56676 — 9router: Image prefetch DNS rebinding allows SSRF to internal services (CVSS 7.4)
• CVE-2026-55501 — 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header (CVSS 7.3)
• CVE-2026-55500 — 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover (CVSS 9.9)
• CVE-2026-59800 — 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint (CVSS 9.8)
• CVE-2026-10269 — decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization (CVSS 6.3)