CVE-2026-46339
📛 CVE Title
(no title)
Description
9router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
Description (MITRE) cveawg.mitre.org
Pulled from cveawg.mitre.org/api/cve/CVE-2026-46339 on 2026-08-01. Shown when MITRE's text differs from the cvelistV5 mirror.
9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- critical
- CVSS score
- —
- CVSS vector
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2026-46339
- Linked Threat
- CVE-2026-46339 — CVE-2026-46339
NVD / KEV / EPSS data refreshed 2026-05-25 00:09 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-44808 - Assigner
- GitHub_M
- Published
- Jul 15, 2026, 8:41:06 PM
- Updated
- Jul 16, 2026, 12:55:46 PM
- EUVD base score (CVSS 3.1)
-
10.0 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EUVD-reported EPSS
- 2.4000
- Vendors
- decolua
- Products
-
9router (0.4.30, < 0.4.37)
- Aliases
-
GHSA-fhh6-4qxv-rpqj
ENISA description: 9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-settings/route.js and command execution through the MCP bridge. This vulnerability is fixed in 0.4.37.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
MITRE references (2) cveawg.mitre.org
Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.
Web references (2)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2026-46339 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2026-46339 tenable:www.cve.org
Remediations (10)
Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.
-
web:blog.cloudlinux.com
Linux kernel ptrace exit-race ( CVE - 2026 -46333) leaks SSH host keys and /etc/shadow. CloudLinux 8 LTS, 9, and 10 affected. Mitigation and status.
2026-05-26 02:56 UTC -
web:lwn.net
These kernels contain a patch for CVE - 2026 -46333 a vulnerability reported by the Qualys Security Advisory team, though Jann Horn proposed a patch in 2020. The vulnerability has a proof-of-concept exploit published already. Some of the kernels have additional patches for other bugs; as always, users are advised to upgrade.
2026-05-26 02:56 UTC -
web:nvd.nist.gov
An official website of the United States government Here's how you know
2026-05-26 02:56 UTC -
web:undercodenews.com
The issue was privately reported to the Linux kernel security team on May 11, 2026 , and a fix was released on May 14, 2026 . However, public disclosure of the patch quickly enabled independent exploit development.
2026-05-26 02:56 UTC -
web:vulert.com
Learn about CVE-2026-46339 , a critical vulnerability in the 9router package that allows unauthenticated remote code execution. Discover how to fix it and protect your application.
2026-05-26 02:56 UTC -
web:www.crowdstrike.com
Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.
2026-05-26 02:56 UTC -
web:www.ibm.com
IBM Support, Fix Central All code (including Machine Code updates, samples, fixes or other software downloads) provided on the Fix Central website is subject to the terms of the applicable license agreements. Machine Code updates for Power Systems and System Storage are available for IBM machines that are under warranty or an IBM hardware maintenance service agreement. Some exceptions apply ...
2026-05-26 02:56 UTC -
web:www.microsoft.com
Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.
2026-05-26 02:56 UTC -
web:www.oracle.com
This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.
2026-05-26 02:56 UTC -
web:zecurit.com
Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .
2026-05-26 02:56 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.