CVE-2026-72860

Name of the Vulnerable Software and Affected Versions 9router (affected versions not specified)

Description An issue exists in the POST /api/provider-nodes/validate endpoint where the application issues server-side HTTP requests to a caller-supplied baseUrl. The security mechanism assertPublicUrl in src/shared/utils/ssrfGuard.js fails to properly validate destinations because it only compares hostname strings without performing DNS resolution or revalidating after redirects. Specifically, the check for IPv4-mapped IPv6 addresses is unreachable because the WHATWG URL parser canonicalizes these literals to hextets before the guard processes them. This allows IPv4-mapped addresses to bypass the filter and reach loopback or link-local metadata addresses. Additionally, hostnames with A records pointing to internal addresses are permitted. In the custom-embedding branch, if the upstream status is not 2xx, 401, or 403, the first 200 bytes of the response body are returned to the caller, potentially disclosing internal information. Other validation types can be used for blind internal port scanning via timing and status differences. The apiKey provided by the caller is forwarded to the internal destination as an Authorization Bearer header. Access typically requires a dashboard session unless requireLogin is disabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.