Decolua 9router vulnerabilities

• decolua 9router 9router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint CVE-2026-108593 7.3 HighOctober 10, 2026
• decolua 9router decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery CVE-2026-103530 6.9 MediumSeptember 30, 2026
• decolua 9router 9Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header CVE-2026-56682 Fix available 5.3 MediumSeptember 22, 2026
• decolua 9router 9Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header CVE-2026-56681 Fix available 7.3 HighSeptember 22, 2026
• decolua 9router 9router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable CVE-2026-72860 6.3 MediumAugust 20, 2026
• decolua 9router 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint CVE-2026-56677 8.6 HighAugust 17, 2026
• decolua 9router 9router before 0.4.60 Remote Code Execution via default password CVE-2026-63732 9.4 CriticalJuly 23, 2026
• decolua 9router 9Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch CVE-2026-63313 8.3 HighJuly 23, 2026
• decolua 9router 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments CVE-2026-62312 8.8 HighJuly 15, 2026
• decolua 9router 9Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding CVE-2026-56678 Fix available 6.4 MediumJuly 15, 2026
• decolua 9router 9Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade CVE-2026-56679 Fix available 8.7 HighJuly 15, 2026
• decolua 9router 9router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs CVE-2026-56675 Fix available 8.3 HighJuly 10, 2026
• decolua 9router 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass CVE-2026-55638 Fix available 8.6 HighJuly 10, 2026
• decolua 9router 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF CVE-2026-55641 Fix available 8.2 HighJuly 10, 2026
• decolua 9router 9router: Image prefetch DNS rebinding allows SSRF to internal services CVE-2026-56676 Fix available 7.4 HighJuly 10, 2026
• decolua 9router 9router: Login brute-force protection bypass via spoofed X-Forwarded-For header CVE-2026-55501 Fix available 7.3 HighJuly 6, 2026
• decolua 9router 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover CVE-2026-55500 9.9 CriticalJuly 6, 2026
• decolua 9router 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints CVE-2026-62328 8.7 HighJuly 6, 2026
• decolua 9router 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats CVE-2026-62327 9.3 CriticalJuly 6, 2026
• decolua 9router 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers CVE-2026-59801 9.3 CriticalJuly 6, 2026
• decolua 9router 9Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING CVE-2026-49353 7.5 HighJuly 2, 2026
• decolua 9router 9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass CVE-2026-49352 Public exploitFix available 9.8 CriticalJuly 2, 2026
• decolua 9router 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint CVE-2026-59800 Fix available 9.2 CriticalJuly 2, 2026
• decolua 9router decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization CVE-2026-10269 5.3 MediumJune 1, 2026
• decolua 9router 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes CVE-2026-46339 Public exploitFix available 10.0 CriticalMay 19, 2026
• decolua 9router decolua 9router Administrative API Endpoint api authorization CVE-2026-5842 Fix available 6.9 MediumApril 9, 2026