CVE-2026-46339: 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

Severity: critical (CVSS 10.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-78

Description

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.

Affected products

decolua 9router: from 0.4.30, < 0.4.37

References

https://github.com/decolua/9router/commit/992f4db4a0d858bcc86b4786f2abab117a6ccdf8
https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj
https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj

Get alerted when CVE-2026-46339 or the next vulnerability affects your stack