CVE-2026-49353

7.5 Élevée

Publiée le 15/07/2026 à 23:16 · Modifiée le 16/07/2026 à 18:19 · Analyse NVD reportée · Source : security-advisories@github.com

Description

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

Traduire en français

Produits concernés

decolua 9router

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N`

Faiblesses (CWE)

CWE-290

Références

https://github.com/decolua/9router/commit/5e1c1261368e06dced1cbc650684561b2c8844db
https://github.com/decolua/9router/commit/bb86808582067e4fc6f004508a919efb9970d1d5
https://github.com/decolua/9router/releases/tag/v0.4.46
https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf
https://github.com/decolua/9router/security/advisories/GHSA-6g2f-w7g3-77vf

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories