This briefing was produced by AI from the linked sources and is scheduled for human editorial review within 24 hours. Read the sources directly for material decisions.
EVIDENCE — GitHub reviewed four 9router vulnerabilities on 23 September 2026: high-severity CVE-2026-56675, CVE-2026-56676, and CVE-2026-56679, plus moderate-severity CVE-2026-56678. The underlying reports and fixes date to July, but the database review makes the affected ranges and corrected versions newly explicit. The first two affect releases through 0.4.80 and are fixed in 0.5.2; CVE-2026-56679 affects releases through 0.5.2 and is fixed in 0.5.4; CVE-2026-56678 also affects 0.5.2 and is fixed in 0.5.6. None of the cited advisories reports exploitation in the wild.
THE PROXY'S ADDRESS BECAME AUTHENTICATION — CVE-2026-56675 appears when a documented same-host reverse proxy forwards public traffic to 9router over loopback. The backend sees nginx at 127.0.0.1, classifies every client as local, and can skip the API-key requirement for non-browser requests to /v1 routes. That exposes model enumeration and may let an unauthenticated caller consume the operator's configured upstream provider credentials and quota. The lesson is broader than one product: socket locality is not user identity after an intermediary has collapsed every source into the same connection origin.
REMOTE IMAGES BECAME AN INTERNAL-NETWORK DIALER — CVE-2026-56676 is a DNS time-of-check/time-of-use flaw in image prefetching. 9router validates a hostname after one DNS answer, then its later fetch resolves the name again; an attacker-controlled name can answer with a public address first and an internal address second. Through a vision request's image_url, the server can then reach private services, cloud metadata, or internal administration endpoints available from the router's container. Controls must apply to the address actually used for the connection and to every redirect, not only to the URL string before the request begins.
A SESSION COULD LOWER THE WALLS OR FORWARD A SECRET — CVE-2026-56679 lets an authenticated user mass-assign security-sensitive settings, including requireLogin, so one session can disable authentication globally and expose stored keys and provider data; it is especially dangerous where the default password remains in use. CVE-2026-56678 separately interpolates an authenticated caller's Kiro region into an upstream hostname, allowing a crafted value to redirect validation and forward the submitted Kiro API key in an Authorization header. These are distinct bugs, but both show why a gateway must separate ordinary configuration from authority-changing fields and construct credential-bearing destinations from fixed allowlists.
WHAT TO CHECK — Upgrade every 9router deployment to 0.5.6 or later, restart it, and verify the running version rather than the image tag alone. Require an API key at both the external edge and the backend; do not treat loopback as a principal. Restrict outbound traffic from the router, block link-local and metadata destinations, and allow remote-image fetching only to approved domains where possible. Replace the default dashboard password, review who can change settings or provider configuration, and rotate stored provider credentials if an instance was exposed. Hunt for unauthenticated /v1 traffic, unexpected image-fetch destinations, changes to requireLogin or tunnelDashboardAccess, Kiro validation requests to non-AWS hosts, and unexplained upstream-model spend.