CVE-2026-49353

Name of the Vulnerable Software and Affected Versions 9Router versions 0.4.45 and earlier

Description An issue exists in the local-only access gate within src/dashboardGuard.js where the isLocalRequest() function relies on the Host and Origin HTTP headers to verify if a request is local. In deployments using reverse proxies or tunnels, these headers can be spoofed by an attacker to bypass the restriction. This allows unauthorized access to spawn-capable routes, specifically the API endpoints /api/mcp/*, /api/tunnel/*, and /api/cli-tools/*.

If an attacker can obtain the CLI token—which is a deterministic HMAC of the machine ID—they can interact with MCP child processes (such as node, python, npx, bun, or uvx) via stdin. This can lead to remote code execution on the host system.

Recommendations Update 9Router to a version later than 0.4.45. As a temporary mitigation, restrict access to the /api/mcp/*, /api/tunnel/*, and /api/cli-tools/* endpoints at the network layer by binding them to the loopback address (127.0.0.1).