https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T03:17:29.895162+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-338279 EUVD-2026-338279 2026-10-06T03:17:29.943959+00:00 EUVD-2026-338279 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49353 fkie_cve-2026-49353 2026-10-06T03:17:29.943996+00:00

9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.

 https://cve.radiocsirt.org/vuln/ghsa-6g2f-w7g3-77vf GHSA-6g2f-w7g3-77vf — 9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING 2026-10-06T03:17:29.944031+00:00

Affected: npm: 9router

## Summary

The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in `src/dashboardGuard.js` that restricts spawn-capable routes (`/api/mcp/*`, `/api/tunnel/*`, `/api/cli-tools/*`) to loopback requests. The gate determines "local" by inspecting the `Host` and `Origin` HTTP headers rather than the TCP source address. When 9router is deployed behind a reverse proxy, tunnel (Cloudflare Tunnel, Tailscale — both natively supported), or is subject to DNS rebinding, these headers are attacker-controlled, allowing the local-only gate to be bypassed.

A second factor (CLI token or JWT cookie) is required by `canAccessLocalOnlyRoute()`, but the CLI token is a deterministic HMAC of the machine ID (`getConsistentMachineId`), which is stable and predictable on cloud VMs. If the attacker can obtain or guess the machine ID (e.g., via another information disclosure, or on shared-tenant infrastructure), the full chain to MCP child process stdin injection is reachable.

This is a variant / incomplete fix of CVE-2026-46339 — the same attack surface (remote → MCP child process stdin) remains reachable under specific but realistic deployment configurations.

## Root Cause

`isLocalRequest()` at `src/dashboardGuard.js:93-101`:

```javascript function isLocalRequest(request) { if (!isLoopbackHostname(request.headers.get("host"))) return false; const origin = request.headers.get("origin"); if (origin) { try { if (!isLo…