CVE-2026-49353
9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
HIGH 7.5EPSS 0.4%
9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.
- Affected
- decolua · 9router
- CVSS v3.1 GITHUB
- 7.5 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N - EPSS
- 0.36% chance of exploitation in the next 30 days, 28th percentile
- Published
- 2026-07-15
- Updated
- 2026-07-16