{"data":{"id":"289292a9-da9d-44a6-b587-128ec275b62b","title":"GHSA-86m2-fcxq-5q7c: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF","summary":"9router's request guard treats a request as local, and so exempt from API-key auth on the `/v1` LLM proxy, based on the client-controlled `Host` header in `isLocalRequest` (`src/dashboardGuard.js`). Because the default `DEFAULT_HOST` is `0.0.0.0` and `requireApiKey` is absent from `DEFAULT_SETTINGS`, a remote unauthenticated attacker sending `Host: localhost` gets an open AI relay using the victim's stored API keys, plus unauthenticated SSRF through `/v1/search` via `provider_options.baseUrl` with the `searxng` provider. Affected: 9router <= 0.4.80.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-86m2-fcxq-5q7c","publishedAt":"2026-08-28T18:33:20.000Z","cveId":"CVE-2026-55641","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other","supply_chain"],"issueType":"vulnerability","affectedPackages":["9router@< 0.5.2 (fixed: 0.5.2)"],"affectedPackageNames":["9router"],"affectedPackageRefs":["npm:9router"],"affectedVendors":[],"affectedVendorsRaw":["9router"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00326,"epssCheckedAt":"2026-11-05T00:11:43.030Z","kevDateAdded":null,"advisoryAliases":["GHSA-86m2-fcxq-5q7c"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-08-28T18:33:20.000Z","fixReleasedAt":"2026-06-17T04:58:44.436Z","daysToFix":-72,"fixCheckedAt":"2026-10-29T21:31:06.830Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[{"ecosystem":"npm","name":"9router","fixedVersion":"0.5.2","matchedVersion":"0.5.2","fixReleasedAt":"2026-06-17T04:58:44.436Z","daysToFix":-72,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:31:06.683Z"}]}}