Server-Side Request Forgery in Router-for-Me CLIProxyAPI 6.9.29
CVE-2026-8081

5.3MEDIUM

Key Information:

Vendor: Router-for-me
Status: Cliproxyapi
Vendor: CVE Published:; 7 May 2026

🔔 Create Router-for-me Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-8081?

A server-side request forgery (SSRF) vulnerability has been identified in Router-for-Me's CLIProxyAPI version 6.9.29, specifically targeting the internal/api/handlers/management/api_tools.go file. This issue arises from inadequate validation of the 'url' argument, allowing an attacker to manipulate it for unauthorized requests to internal resources. Given its public disclosure, this vulnerability poses a risk for remote exploitation. The vendor was approached regarding the severity of the issue but has not provided a response.

Affected Version(s)

CLIProxyAPI 6.9.29

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-8081 - Proof of Concept