SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-56675

HIGH · CVSS 8.3 EPSS 0.32% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-10 · Last synced 2026-08-09

CyberRota Analysis

AI-Generated

The vulnerability affects 9Router versions prior to 0.5.2, where loopback requests are incorrectly treated as trusted, allowing unauthenticated remote attackers to access sensitive /v1 APIs without an API key. This misclassification can lead to unauthorized access to backend services and potential abuse of upstream provider credentials. Organizations using affected versions of 9Router should prioritize upgrading to version 0.5.2 to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-56675
Severity
HIGH
CVSS
8.3
EPSS
0.32%

Original NVD Description

9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.