CVE-2026-63732: 9router before 0.4.60 Remote Code Execution via default password
9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCALONLY network gate via a spoofed Host header, and unvalidated arguments passed to childprocess.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin (e.g. node -e <payload>) to achieve arbitrary code execution on the host operating system when the plugin's SSE endpoint is triggered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
9routerto a version that resolves this vulnerability.Fixed in 0.4.60 - Configuration
Ensure the hardcoded default credential (123456) is not used by changing to a unique strong password immediately; do not leave fresh installations with the default password enabled.
9router default_password = Change from 123456 to a unique strong password before exposure - Configuration
Fix the LOCAL_ONLY route gating so it cannot be bypassed by a spoofed Host header; do not accept Host header values as authoritative for reachability to local-only routes.
9router LOCAL_ONLY network gate = Use unspoofable request criteria (do not rely on Host header) - Configuration
Prevent RCE by validating and/or allowlisting all untrusted arguments passed to child_process.spawn() during MCP plugin registration.
9router MCP plugin registration child_process.spawn() argument validation = Validate/allowlist untrusted arguments before spawn
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63732?
The severity of CVE-2026-63732 is critical with a score of 9.9.
How do I fix CVE-2026-63732?
To fix CVE-2026-63732, upgrade to 9router version 0.4.60 or later.
What kind of vulnerability is CVE-2026-63732?
CVE-2026-63732 is a remote code execution vulnerability due to a hardcoded default password.
What are the consequences of CVE-2026-63732?
Exploitation of CVE-2026-63732 can lead to unauthorized remote code execution on affected devices.
What conditions allow CVE-2026-63732 to be exploited?
CVE-2026-63732 can be exploited if the default hardcoded password is used on unprotected installations.