Technical impact
9Router is an AI router & token saver. In version 0.4.45 and earlier, the local‑only access gate implemented in src/dashboardGuard.js uses the Host and Origin headers in its isLocalRequest() function to secure the /api/mcp/*, /api/tunnel/*, and /api/cli-tools/* endpoints. This check was intended to allow only local‑only requests, but it fails to properly validate the headers, enabling an attacker to spoof Host or Origin headers when 9Router is deployed behind a reverse proxy or tunnel. The spoofed headers allow the attacker to reach the MCP child process stdin paths, effectively bypassing authentication and potentially enabling unintended actions on the host. This vulnerability is identified as CWE‑290.
Affected Systems
The CVE affects the 9Router AI router from decolua. Versions 0.4.45 and older are impacted. The vulnerability was fixed in release v0.4.46 and later, so any deployment running an earlier release is susceptible.
Risk and Exploitability
The CVSS score of 7.5 indicates a high severity flaw, but the EPSS score is below 1%, suggesting that, as of the latest data, the probability of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to be able to send HTTP requests with arbitrary Host or Origin headers to the 9Router instance, typically through a reverse proxy or tunnel configuration that does not enforce header validation. Based on the description, it is inferred that if an attacker can control these headers, they may be able to access privileged API routes and potentially interact with the MCP child process via its stdin paths, which could enable further unauthorized actions.
Github GHSA