Server-Side Request Forgery Vulnerability in 9router API
CVE-2026-72860

6.3MEDIUM

Key Information:

Vendor

Decolua

Status
9router
Vendor
CVE Published:
20 August 2026

What is CVE-2026-72860?

The 9router API has a vulnerability in its POST /api/provider-nodes/validate route that allows for Server-Side Request Forgery (SSRF). This occurs when a user-supplied baseUrl is processed without proper DNS resolution and hostname validation. The existing guard only checks hostname strings, which means that any IPv4-mapped IPv6 address can bypass this check. As a result, this flaw can lead to unauthorized access to internal network resources and major data exposure. Additionally, the response body from upstream services can be partially disclosed, allowing attackers to gather information about internal systems through timing and status response variations.

Affected Version(s)

9router 0 <= 0.5.55

References

https://github.com/decolua/9router/issues/3293
issue-tracking
https://github.com/decolua/9router/blob/master/src/shared...
technical-description
https://github.com/decolua/9router/blob/master/src/app/ap...
technical-description

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HK4zCzi
.