CVE-2026-72860: Server-Side Request Forgery (SSRF) in decolua 9router

The POST /api/provider-nodes/validate endpoint in 9router accepts a baseUrl parameter and makes server-side HTTP requests to it. The SSRF guard function assertPublicUrl only compares hostname strings without DNS resolution or redirect checks, and its IPv4-mapped IPv6 address handling is ineffective due to URL parser canonicalization. This allows requests to internal loopback and link-local addresses via IPv4-mapped IPv6 literals and hostnames resolving to internal IPs. The vulnerability also leaks up to 200 bytes of internal response bodies for certain HTTP statuses and allows blind internal port scanning through response status and timing differences. The apiKey from the caller is forwarded as an Authorization Bearer header to the internal target. Exploitation requires a dashboard session unless the requireLogin setting is disabled.

An attacker with at least a dashboard session or with requireLogin disabled can exploit this SSRF vulnerability to make unauthorized HTTP requests to internal network resources, potentially accessing sensitive internal services. The vulnerability allows partial disclosure of internal response data and facilitates blind internal port scanning. The forwarding of the apiKey as an Authorization Bearer header to internal destinations could lead to unauthorized access or privilege escalation within internal services. The CVSS score of 8.5 reflects high impact with high confidentiality loss, limited integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the dashboard and ensure requireLogin is enabled to prevent unauthenticated exploitation. Review and enhance SSRF protections to include DNS resolution, redirect validation, and proper handling of IPv4-mapped IPv6 addresses. Avoid forwarding sensitive credentials like apiKey to untrusted internal destinations.