CVE-2026-46339 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Unauthenticated attackers can execute arbitrary commands via unprotected MCP plugin routes in 9Router, requiring an upgrade to secure the application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46339?
CVE-2026-46339 is a critical command injection vulnerability in decolua 9router, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Which versions are affected by CVE-2026-46339?
2 open source packages ship an affected version, including 9router.
| Package | Affected | Fixed in |
|---|---|---|
9router npm | From 0.4.30 | 0.4.37 |
9router npm | From 0.4.30 | 0.4.37 |
How do I fix CVE-2026-46339?
Upgrade 9router to 0.4.37 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-46339 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-46339 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-fhh6-4qxv-rpqj.