The vulnerability in 9router arises from an incomplete fix for CVE-2026-46339. The local-only access gate implemented in src/dashboardGuard.js uses the Host and Origin HTTP headers to verify if a request is from a loopback address. However, these headers are attacker-controlled when 9router is behind a reverse proxy, tunnel, or DNS rebinding attack, allowing bypass of the local-only restriction. Access to restricted MCP routes requires a CLI token, which is a deterministic HMAC of the machine ID and thus predictable in some environments. An attacker who obtains or guesses this token can establish server-sent events (SSE) sessions and send arbitrary JSON-RPC commands to child processes such as node, python, or npx, enabling remote code execution on the host. The vulnerability affects versions <=0.4.55 and requires specific deployment conditions and token knowledge for exploitation.

An attacker able to reach a proxied or tunneled 9router instance and obtain the deterministic CLI token can bypass the local-only access gate and interact with MCP child processes via stdin. This interaction can lead to arbitrary code execution on the host system. The impact is a remote code execution vulnerability with high severity, though exploitation requires specific deployment scenarios and token acquisition, reducing the overall risk compared to the original CVE-2026-46339.

No official patch or fix is currently confirmed. Recommended mitigations include: (1) modifying the local-only access gate to verify the actual source IP address (e.g., using request.ip or request.socket.remoteAddress) rather than trusting Host and Origin headers; (2) replacing the deterministic CLI token with a non-deterministic, randomly generated token persisted on first run; and (3) binding MCP routes to the loopback interface at the network layer to enforce local-only access. Users should monitor vendor advisories for official fixes and apply them once available.