Vulnerability in Decolua 9router
CVE-2026-56681
9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This permits unauthorized use of the instance owner's configured LLM providers, consumption of paid credits, and enumeration of configured providers and models. This issue is fixed in version 0.5.6.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Decolua 9router — versions < 0.5.6
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-56681?
- CVE-2026-56681 is a high-severity vulnerability in Decolua 9router, classified under CWE-807. CVSS score: 7.3/10. Published 2026-09-22.
- How severe is CVE-2026-56681?
- High severity. CVSS v3 base score is 7.3 out of 10.