Skip to content
Threat Feed
Subscribe

Product

9Router < 0.4.72

1 brief RSS
high advisory

CVE-2026-63313 - Server-Side Request Forgery in 9Router

9Router versions prior to 0.4.72 contain a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint, allowing an authenticated or locally-connected user to bypass URL validation to fetch arbitrary internal URLs, potentially exposing cloud metadata credentials, accessing internal services, and bypassing authentication on localhost endpoints.

9Router < 0.4.72 ssrf vulnerability web-application router
1r 4t 1c