CVE-2026-8081

router-for-me CLIProxyAPI api_tools.go server-side request forgery

View on CVE.org
Published May 7, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api_tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability in router‑for‑me CLIProxyAPI 6.9.29 allows an attacker to manipulate the "url" argument in the internal API handler to trigger a server‑side request forgery. This flaw can lead to the API server making arbitrary outbound requests to internal or external resources controlled by the attacker, potentially exposing sensitive data or facilitating further attacks. The flaw is categorized as CWE‑918 and the description confirms that remote exploitation is possible.

Affected Systems

Router‑for‑me CLIProxyAPI version 6.9.29 is affected. No other product versions are listed in the current data, and the vulnerability is tied specifically to the internal/api/handlers/management/api_tools.go component.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to send crafted input to the API, typically via an exposed endpoint, and does not require additional credentials. Consequently, the risk is present in environments where the API is reachable from untrusted networks, and exploitation could be performed by remote actors.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Obtain and install an updated release of CLIProxyAPI that contains the fix for the SSRF flaw, or apply the vendor’s official patch if available.
  • If a patch is not immediately available, restrict the CLIProxyAPI service’s outbound traffic to only the IP ranges and ports needed for legitimate operation, blocking access to internal or sensitive networks.
  • Configure a reverse proxy or API gateway to validate and limit destination URLs, ensuring that only approved domains or IP prefixes can be requested by the service.
  • Monitor the service logs for unexpected outbound requests and investigate any anomalies promptly.

Generated by OpenCVE AI on May 7, 2026 at 19:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:router-for-me:cliproxyapi:6.9.29:*:*:*:*:*:*:*
Type Values Removed Values Added
First Time appeared Router-for-me
Router-for-me cliproxyapi
Vendors & Products Router-for-me
Router-for-me cliproxyapi
Type Values Removed Values Added
Description A vulnerability has been found in router-for-me CLIProxyAPI 6.9.29. Affected by this issue is some unknown functionality of the file internal/api/handlers/management/api_tools.go of the component API Interface. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title router-for-me CLIProxyAPI api_tools.go server-side request forgery
Weaknesses CWE-918
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
May 7, 2026, 6:08 PM
Reserved
May 7, 2026, 12:11 PM

View source JSON

Updated
May 7, 2026, 6:08 PM

JSON

Status
Analyzed
Published
May 7, 2026, 6:16 PM
Modified
Oct 26, 2026, 12:10 AM

View source JSON

No data.

Updated
May 7, 2026, 9:24 PM

JSON