CVE-2026-46339 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-46339 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-46339 is a critical authentication bypass and command-execution flaw in 9Router affecting versions 0.4.30 through 0.4.37. The bug leaves /api/cli-tools/* and /api/mcp/* insufficiently protected in src/proxy.js, enabling unauthenticated registration of custom plugins via src/app/api/cli-tools/cowork-settings/route.js and potential command execution through the MCP bridge.

Fix status: the issue is reported as fixed in 0.4.37. Even though there is no known exploitation in the wild and it is not in CISA KEV, the severity is CRITICAL (CVSS 10) because a remote attacker may be able to take over the service or run arbitrary commands.

Immediate Action

  • Upgrade immediately to 9Router 0.4.37 or later. If you cannot patch right away, take the service offline or isolate it behind a private network/VPN.
  • Block access to /api/cli-tools/* and /api/mcp/* at your reverse proxy, WAF, or ingress layer until patched.
  • Disable plugin registration and MCP bridge features if your deployment allows feature flags or environment toggles.
  • Assume compromise is possible if the instance was exposed to the internet while running a vulnerable version; review logs for suspicious plugin creation or command activity.
  • Rotate secrets used by the router, connected model providers, and any downstream systems that may have been reachable from the service.
  • See vendor guidance: vendor advisory / release notes (placeholder link if unavailable).

Affected Versions

  • 9Router >= 0.4.30 and < 0.4.37 vulnerable
  • 9Router 0.4.37+ safe, per advisory
  • If you pin by image tag, 9router:0.4.37 or newer is the minimum known-fixed release

Resolution Guide

JavaScript / Node.js

npm install 9router@0.4.37
# or
yarn add 9router@0.4.37
# or
pnpm add 9router@0.4.37

Python (if packaged via pip/pipx in your environment)

pip install --upgrade 9router==0.4.37
# or
pipx upgrade 9router

Java (if your build pulls a published artifact; replace TODO coordinates)

// Maven
<dependency>
  <groupId>TODO.group</groupId>
  <artifactId>TODO-artifact</artifactId>
  <version>0.4.37</version>
</dependency>

// Gradle
implementation("TODO.group:TODO-artifact:0.4.37")

Linux package managers (only if your distro packages 9Router; otherwise use the app-specific update path)

sudo apt update
sudo apt install --only-upgrade 9router

sudo yum update 9router
# or
sudo dnf update 9router

Docker

docker pull 9router:0.4.37
docker stop 9router
docker rm 9router
docker run -d --name 9router 9router:0.4.37

Hardening while you patch

# Example reverse proxy blocks
location ^~ /api/cli-tools/ { return 403; }
location ^~ /api/mcp/ { return 403; }
# Example feature flags / env vars (adjust to your app)
DISABLE_CLI_TOOLS=true
DISABLE_MCP_BRIDGE=true
ALLOW_PLUGIN_REGISTRATION=false

Minimal code fix pattern if you maintain a local fork: ensure middleware enforces auth before any handler under these paths.

// src/proxy.js (illustrative)
if (req.path.startsWith('/api/cli-tools/') || req.path.startsWith('/api/mcp/')) {
  if (!req.user) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
}

Detection & Verification

Check your version

node -p "require('./package.json').dependencies?.['9router'] || require('./package.json').devDependencies?.['9router']"
npm ls 9router
yarn why 9router
pnpm why 9router

Search for exposed routes and risky config

grep -RIn "/api/cli-tools\|/api/mcp\|customPlugins\|cowork-settings" src .
grep -RIn "DISABLE_CLI_TOOLS\|DISABLE_MCP_BRIDGE\|ALLOW_PLUGIN_REGISTRATION" .

Check container/image tags

docker images | grep 9router
docker inspect 9router --format '{{.Config.Image}}'

Look for signs of abuse

# Examples: unexpected plugin registrations, new routes, or command execution logs
grep -RIn "customPlugins\|plugin registered\|mcp\|exec\|spawn" logs/ .

Verify the fix

# After upgrading, confirm the installed version
npm ls 9router

# Test blocked endpoints from a non-authenticated context
curl -i https://your-host/api/cli-tools/cowork-settings
curl -i https://your-host/api/mcp/

Expected result after remediation: unauthenticated requests to these endpoints should return 401 or 403, and the service should no longer accept plugin registration or MCP bridge actions without proper auth.

Risk and Impact

This flaw can let a remote attacker bypass authentication and reach sensitive administrative or execution paths. In practical terms, that can mean unauthorized plugin registration, command execution, data exposure, or full compromise of the host running 9Router.

For solo developers and small teams, the blast radius can be especially large because these deployments often share API keys, internal network access, and production secrets on a single box. Treat any exposed vulnerable instance as high risk and patch or isolate it immediately.

Keep reading