CVE-2026-56675: 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs
9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as trusted and allows /v1/ access without an API key, so a same-host reverse proxy that forwards public traffic to the backend through 127.0.0.1 causes src/dashboardGuard.js to misclassify external requests as local. A remote unauthenticated attacker can access /v1 APIs such as /v1/models and may abuse configured upstream provider credentials through /v1 proxy endpoints depending on enabled providers. This issue is fixed in version 0.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
9routerto a version that resolves this vulnerability.Fixed in 0.5.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56675?
CVE-2026-56675 has a severity rating of 8.3, which is classified as high.
How do I fix CVE-2026-56675?
To mitigate CVE-2026-56675, update to 9Router version 0.5.2 or later, which addresses this vulnerability.
What type of vulnerability is CVE-2026-56675?
CVE-2026-56675 is a reverse proxy locality collapse vulnerability allowing unauthenticated access to 9Router /v1 APIs.
What are the risks associated with CVE-2026-56675?
The risks include unauthorized access to sensitive API endpoints and potential data exposure due to trust in loopback requests.
Which software is affected by CVE-2026-56675?
CVE-2026-56675 affects the 9Router software prior to version 0.5.2.