{"id":"CVE-2026-46339","summary":"9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes","details":"9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.","aliases":["GHSA-fhh6-4qxv-rpqj"],"modified":"2026-08-04T11:49:49.736329505Z","published":"2026-07-15T20:41:06.937Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-306","CWE-78"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46339.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46339.json"},{"type":"ADVISORY","url":"https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46339"},{"type":"FIX","url":"https://github.com/decolua/9router/commit/992f4db4a0d858bcc86b4786f2abab117a6ccdf8"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/decolua/9router","events":[{"introduced":"76f3d4b74e79c0e9c3a7cfcbadfee016fbd66b9b"},{"fixed":"7f7b86f70efc21574cd4f611c9bb3a6a96c01559"}],"database_specific":{"extracted_events":[{"introduced":"0.4.30"},{"fixed":"0.4.37"}],"source":"AFFECTED_FIELD"}}],"versions":["v0.4.36","v0.4.33","v0.4.31","v0.4.30"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46339.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}