CVE-2026-46339 9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

🗓️ 15 Jul 2026 20:41:06Reported by GitHub_MType

CVE-2026-46339: Unauthenticated remote code execution in 9Router via unprotected MCP and CLI routes, fixed in 0.4.37.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-46339	13 May 202613:15	–	circl
CVE	CVE-2026-46339	15 Jul 202620:41	–	cve
Github Security Blog	9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING	2 Jul 202621:13	–	github
Github Security Blog	9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202619:22	–	github
Github Security Blog	9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass	2 Jul 202620:56	–	github
GitLab Advisory Database	9router has an Incomplete Fix: Local-Only Access Gate Bypass in 9router via Host Header SpoofING	2 Jul 202600:00	–	gitlab
GitLab Advisory Database	9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202600:00	–	gitlab
Nuclei	9Router <= 0.4.36 - Unauthenticated RCE	15 Jul 202604:32	–	nuclei
NVD	CVE-2026-46339	15 Jul 202621:16	–	nvd
OSV	GHSA-FHH6-4QXV-RPQJ 9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes	19 May 202619:22	–	osv

[
  {
    "vendor": "decolua",
    "product": "9router",
    "versions": [
      {
        "version": ">= 0.4.30, < 0.4.37",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/decolua/9router/commit/992f4db4a0d858bcc86b4786f2abab117a6ccdf8
github	www.github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj

15 Jul 2026 20:41Current

CVSS 3.110

EPSS0.00147