Zurück zur CVE-Übersicht
CVE-2026-49353
HIGH(7.5)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
Risk Signal Score29/100 — MITTEL
- CVSS 7.5 — Hoch
- Weniger als 24 Stunden alt
Beschreibung
9Router is an AI router & token saver. In 0.4.45 and earlier, 9Router's src/dashboardGuard.js local-only access gate used Host and Origin headers in isLocalRequest() to protect /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*, allowing header spoofing in reverse proxy or tunnel deployments to reach MCP child process stdin paths.
GitHub Advisories
GHSA-6g2f-w7g3-77vfHIGH
9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
npm/9router
GitHub Advisory