9router Authentication Bypass and SSRF via Host Header Spoofing

9router versions 0.4.80 and earlier contain a critical authentication bypass vulnerability (CVE-2026-55641) located in the application's request guard logic. The isLocalRequest function determines if a request should be exempt from API authentication by inspecting the client-controlled Host header rather than the actual socket peer address. Because 9router defaults to binding to 0.0.0.0 (all interfaces) while misleadingly reporting the service as bound to "localhost," remote attackers can reach the service and spoof Host: localhost to be treated as local users.

This bypass grants unauthenticated access to the /v1 proxy. Attackers can leverage this to exhaust the victim's paid AI provider quotas (AI relay) or conduct SSRF attacks. The SSRF primitive is particularly severe as the /v1/search endpoint allows arbitrary configuration of the outbound baseUrl via request parameters, enabling attackers to target internal services or cloud metadata endpoints and receive the response directly in the JSON output. The issue is exacerbated by default settings that lack mandatory API key requirements for non-loopback traffic.

Attack Chain

1. Attacker identifies an internet-facing 9router instance listening on port 20128.
2. Attacker sends a specially crafted HTTP request to the target /v1/search or /v1/messages endpoint.
3. Attacker sets the HTTP Host header to localhost to bypass the isLocalRequest guard check.
4. 9router middleware incorrectly validates the request as originating from a local source due to the spoofed header.
5. The application grants the request bypass-level access, skipping the hasValidApiKey check.
6. For search requests, the attacker injects an arbitrary baseUrl (e.g., http://169.254.169.254/) via the provider_options body parameter.
7. 9router's handleSearchCore performs a server-side fetch to the attacker-supplied URL.
8. The JSON response from the internal resource is reflected back to the attacker, completing the SSRF or unauthorized relay chain.

Impact

Successful exploitation allows remote, unauthenticated attackers to perform unauthorized actions on behalf of the victim. This results in the depletion of financial credits or usage quotas on connected AI provider accounts, the potential exfiltration of prompts and data via the AI relay, and the ability to map internal networks or exfiltrate cloud metadata via the SSRF primitive. Any deployment of 9router reachable over a network is vulnerable to this attack.

Recommendation

1. Upgrade to 9router version 0.5.2 or later immediately to patch the authentication logic.
2. If an immediate upgrade is not possible, modify the 9router configuration to bind only to 127.0.0.1 and ensure it is not reachable from untrusted networks.
3. Implement network-level access control (firewall or VPN) to restrict access to port 20128 to known, authorized IP addresses.
4. Enable mandatory API key authentication for all requests in the 9router settings, regardless of perceived request origin.
5. Use the provided POC methods against lab environments to verify that incoming requests are correctly rejected when the Host header does not match the actual connection source.