Back to overview

CVE-2026-49353

HIGH Exploitation: PoC
7.5
CVSS 3.1
Description
9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

Metadata

CVE ID
CVE-2026-49353
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-05-29 14:35 UTC
Published
2026-07-15 20:49 UTC
Last updated
2026-07-16 15:12 UTC
Primary CWE
CWE-290
CWE-290: Authentication Bypass by Spoofing
Vendor / Product
decolua / 9router
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
SSVC — CISA Coordinator
Exploitation
PoC
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
decolua 9router — <= 0.4.45
Weakness (CWE)
CWESourceDescription
CWE-290 cna CWE-290: Authentication Bypass by Spoofing
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 cna CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
References (4)
Back to overview