Beveiligingsadvies

CVE-2026-55638

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-07-10 15:38:21

Laatst bijgewerkt 2026-07-10 16:46:33

Toegewezen door GitHub_M

CVSS-score 8.6

Status PUBLISHED

Beschrijving

9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. This issue is fixed in version 0.5.2.

← Alle CVE's bekijken Bekijk op cve.org ↗