{"uuid": "36cf1578-d1ff-4cb3-a02f-bcc71d331c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-56677", "type": "seen", "source": "https://gist.github.com/alon710/2e62558f8ce5c6b39d8a9a9db22fa826", "content": "# CVE-2026-56677: CVE-2026-56677: Unauthenticated Server-Side Request Forgery in 9Router OIDC Test Endpoint\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-56677\n\n## Summary\nA high-severity security vulnerability exists in 9Router, an AI router and token saver dashboard. When dashboard authentication features are disabled or left in default configurations, the application exposes administrative testing routines directly to the public internet. Unauthenticated network adversaries can exploit the OIDC configuration validation endpoint to initiate arbitrary HTTP requests, routing unauthorized traffic to local loops, adjacent container ports, and cloud resource metadata interfaces.\n\n## TL;DR\nUnauthenticated network attackers can exploit a testing endpoint in 9Router (<= 0.5.4) to execute Server-Side Request Forgery (SSRF), gaining unauthorized access to internal services and cloud instance metadata.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-918, CWE-306\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 8.6 (High)\n- **EPSS Score**: N/A\n- **Impact**: High Integrity, Low Confidentiality, Low Availability\n- **Exploit Status**: Proof of Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- 9Router AI dashboard platforms running version 0.5.4 or earlier\n- **9router**: <= 0.5.4 (Fixed in: `Verify config changes (Require API key ON)`)\n\n## Mitigation\n\n- Ensure that 'Require API key' is toggled to ON in the dashboard settings\n- Implement DNS lookup validation before issuing outbound network connections to user-controlled URLs\n- Restrict container egress traffic to block outbound calls to localhost, RFC 1918 subnets, and cloud metadata blocks\n\n**Remediation Steps:**\n1. Log in to the 9Router administrative dashboard\n2. Go to the Endpoint & Key configurations panel\n3. Enable the 'Require API key' option to block unauthenticated access\n4. Deploy egress network security rules in your firewall or VPC to isolate outbound calls\n\n## References\n\n- [GitHub Security Advisory GHSA-8g4w-4ffg-8vgx](https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx)\n- [CVE-2026-56677 Record](https://www.cve.org/CVERecord?id=CVE-2026-56677)\n- [9Router GitHub Page Repository](https://github.com/decolua/9router)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-56677) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T01:32:24.606380Z"}