https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 13:01:31 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-335735 EUVD-2026-335735 https://cve.radiocsirt.org/vuln/euvd-2026-335735 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55641 <p>9Router is an AI router &amp; token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/search with the searxng provider_options.baseUrl parameter to drive server-side requests to internal or cloud-metadata hosts. This issue is fixed in version 0.5.2.</p> <p>9Router is an AI router &amp; token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/search with the searxng provider_options.baseUrl parameter to drive server-side requests to internal or cloud-metadata hosts. This issue is fixed in version 0.5.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55641 https://cve.radiocsirt.org/vuln/ghsa-86m2-fcxq-5q7c <p><strong>Affected:</strong> npm: 9router</p> <p>## Summary</p> <p>9router&#39;s request guard decides a request is &#34;local&#34; (and therefore exempt from API-key auth on the `/v1` LLM proxy) by reading the **client-controlled `Host` header**. Because 9router binds `0.0.0.0` by default (and the CLI misleadingly prints &#34;localhost&#34;), a remote, unauthenticated attacker who can reach the port can send `Host: localhost` to be treated as local and obtain `/v1` proxy access with **no API key, no CLI token, and no dashboard login**. In the default configuration (`requireApiKey` is absent from `DEFAULT_SETTINGS`, so the handler-side key check is skipped), this yields:</p> <p>- **Open AI relay** — the proxy forwards the attacker&#39;s requests to AI providers using the **victim&#39;s stored paid API keys** (cost/quota theft, prompt-based data exfiltration through the victim&#39;s accounts). - **Unauthenticated SSRF** — `/v1/search` with the built-in `noAuth` `searxng` provider takes its outbound fetch URL from the request body (`provider_options.baseUrl`), so the attacker drives a server-side fetch to any internal/cloud-metadata host and gets the JSON response reflected back.</p> <p>- **Affected:** `9router &lt;= 0.4.80` (current), `src/dashboardGuard.js` (`isLocalRequest`), `src/sse/handlers/{chat,search}.js`, `src/lib/db/repos/settingsRepo.js`, `cli/cli.js`. - **Distinct from** the existing advisories GHSA-fhh6-4qxv-rpqj (MCP-plugin RCE, patched) and GHSA-xrrh-p7f2-27vm (legacy `&lt;0.3.75` authz bypass).</p> <p>## Details</p> <p>### The bypass (`src/dashboardGuard.js`) ```js function…</p> <p><strong>Affected:</strong> npm: 9router</p> <p>## Summary</p> <p>9router&#39;s request guard decides a request is &#34;local&#34; (and therefore exempt from API-key auth on the `/v1` LLM proxy) by reading the **client-controlled `Host` header**. Because 9router binds `0.0.0.0` by default (and the CLI misleadingly prints &#34;localhost&#34;), a remote, unauthenticated attacker who can reach the port can send `Host: localhost` to be treated as local and obtain `/v1` proxy access with **no API key, no CLI token, and no dashboard login**. In the default configuration (`requireApiKey` is absent from `DEFAULT_SETTINGS`, so the handler-side key check is skipped), this yields:</p> <p>- **Open AI relay** — the proxy forwards the attacker&#39;s requests to AI providers using the **victim&#39;s stored paid API keys** (cost/quota theft, prompt-based data exfiltration through the victim&#39;s accounts). - **Unauthenticated SSRF** — `/v1/search` with the built-in `noAuth` `searxng` provider takes its outbound fetch URL from the request body (`provider_options.baseUrl`), so the attacker drives a server-side fetch to any internal/cloud-metadata host and gets the JSON response reflected back.</p> <p>- **Affected:** `9router &lt;= 0.4.80` (current), `src/dashboardGuard.js` (`isLocalRequest`), `src/sse/handlers/{chat,search}.js`, `src/lib/db/repos/settingsRepo.js`, `cli/cli.js`. - **Distinct from** the existing advisories GHSA-fhh6-4qxv-rpqj (MCP-plugin RCE, patched) and GHSA-xrrh-p7f2-27vm (legacy `&lt;0.3.75` authz bypass).</p> <p>## Details</p> <p>### The bypass (`src/dashboardGuard.js`) ```js function…</p> https://cve.radiocsirt.org/vuln/ghsa-86m2-fcxq-5q7c