Decolua 9router
18 CVEs affecting Decolua 9router. Latest disclosed: 2026-07-15. Critical: 6, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-46339 | Critical | 10.0 | 2026-07-15 | 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing un… |
CVE-2026-55500 | Critical | 9.9 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export (containing all credentials, API keys… |
CVE-2026-49352 | Critical | 9.8 | 2026-07-15 | 9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api… |
CVE-2026-59801 | Critical | 9.8 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints… |
CVE-2026-59800 | Critical | 9.8 | 2026-07-07 | 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not cove… |
CVE-2026-62327 | Critical | 9.1 | 2026-07-13 | 9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for… |
CVE-2026-62312 | High | 8.8 | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating… |
CVE-2026-55638 | High | 8.6 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before… |
CVE-2026-56675 | High | 8.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/* access without an API key, so a same-host r… |
CVE-2026-55641 | High | 8.2 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header… |
CVE-2026-49353 | High | 7.5 | 2026-07-15 | 9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalReq… |
CVE-2026-62328 | High | 7.5 | 2026-07-13 | 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by se… |
CVE-2026-56676 | High | 7.4 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/ima… |
CVE-2026-55501 | High | 7.3 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in src/lib/auth/loginLimiter.js derives the client identity from the a… |
CVE-2026-5842 | High | 7.3 | 2026-04-09 | A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Admin… |
CVE-2026-56678 | Medium | 6.4 | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-co… |
CVE-2026-10269 | Medium | 6.3 | 2026-06-01 | A security vulnerability has been detected in decolua 9router up to 0.4.0. This issue affects the function isAuthenticated of the file src/dashboardGuard.js of… |
CVE-2026-56679 | | 2026-07-15 | 9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field w… |