CVE-2026-55638

🗓️ 10 Jul 2026 15:38:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 77 Views🌐 WEB

Unauthenticated access to /codex bypasses the API key gate, enabling upstream calls with stored LLM credentials.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-55638	10 Jul 202622:49	–	circl
Cvelist	CVE-2026-55638 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass	10 Jul 202615:38	–	cvelist
EUVD	EUVD-2026-42931	28 Aug 202618:32	–	euvd
Github Security Blog	9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass	28 Aug 202618:32	–	github
GitLab Advisory Database	9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass	28 Aug 202600:00	–	gitlab
Mend	CVE-2026-55638	10 Jul 202615:38	–	mend
NVD	CVE-2026-55638	10 Jul 202617:16	–	nvd
osv_ghsa	GHSA-8GMQ-J984-VP4R 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass	28 Aug 202618:32	–	osv_ghsa
Patchstack	NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass	28 Aug 202618:32	–	patchstack
Positive Technologies	PT-2026-57219	10 Jul 202600:00	–	ptsecurity

Vulners

Node

decolua 9routerRange<0.5.2

[
  {
    "vendor": "decolua",
    "product": "9router",
    "versions": [
      {
        "version": "< 0.5.2",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/decolua/9router/releases/tag/v0.5.2
github	www.github.com/decolua/9router/commit/b282f0554972ea35281520738759d76abcd0b0b3
github	www.github.com/decolua/9router/security/advisories/GHSA-8gmq-j984-vp4r

Parameter	Position	Path	Description	CWE
*	path	/codex/*	Unauthenticated access to the /codex/* path allows an attacker to bypass the API-key gate and trigger upstream provider calls using operator-stored credentials.	CWE-862, CWE-863

10 Jul 2026 17:35Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.18.6

EPSS0.00611

SSVC