CVE-2026-63313 is an SSRF vulnerability in decolua's 9Router before version 0.4.72. The /v1/web/fetch endpoint accepts a URL parameter passed to external scraping providers without adequate validation against private IPs, cloud metadata endpoints, or internal hostnames. This allows an authenticated or local user to induce the server to make arbitrary internal requests, exposing sensitive internal resources such as cloud metadata services and localhost endpoints that may bypass authentication.

Exploitation of this SSRF vulnerability can lead to unauthorized read access to internal services, including cloud metadata endpoints that may contain sensitive credentials. This can result in credential exposure, unauthorized internal network access, and potential bypass of authentication mechanisms on localhost services. The vulnerability is rated high severity with a CVSS 4.0 score of 8.3, indicating significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /v1/web/fetch endpoint to trusted users and networks only. Implement network-level controls to block server-side requests to internal IP ranges and cloud metadata endpoints. Monitor for unusual internal request patterns originating from this endpoint.