CVE-2026-55641 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
Remote attackers can bypass authentication and trigger server-side requests to internal hosts by spoofing the Host header in 9router.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55641?
CVE-2026-55641 is a high-severity server-side request forgery vulnerability in decolua 9router, published on 10 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication. In the default configuration, this exposes the /v1 proxy to upstream provider calls using stored provider credentials and allows /v1/search with the searxng provider_options.baseUrl parameter to drive server-side requests to internal or cloud-metadata hosts. This issue is fixed in version 0.5.2.
Which versions are affected by CVE-2026-55641?
2 open source packages ship an affected version, including 9router.
| Package | Affected | Fixed in |
|---|---|---|
9router npm | All versions | 0.5.2 |
9router npm | All versions | 0.5.2 |
How do I fix CVE-2026-55641?
Upgrade 9router to 0.5.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-55641 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55641 exists.
Sources
Also known as GHSA-86m2-fcxq-5q7c.