Decolua vulnerabilities
26 CVEs and advisories name Decolua as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-1085939router 0.4.1 through 0.5.99 Config Injection RCE via hermes-settings Endpoint
- CVE-2026-103530decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery
- CVE-2026-566829Router: Login Brute-Force Lockout Bypass via Spoofable X-9r-Real-Ip Header
- CVE-2026-566819Router: Authentication Bypass in Public LLM API via Spoofable X-9r-Real-Ip Header
- CVE-2026-728609router Server-Side Request Forgery via /api/provider-nodes/validate Because the IPv4-Mapped IPv6 Denylist Check Is Unreachable
- CVE-2026-566779Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
- CVE-2026-637329router before 0.4.60 Remote Code Execution via default password
- CVE-2026-633139Router before 0.4.72 Server-Side Request Forgery via /v1/web/fetch
- CVE-2026-623129Router: Authenticated RCE via Unvalidated MCP Plugin Arguments
- CVE-2026-566789Router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
- CVE-2026-566799Router: Mass assignment in PATCH /api/settings allows authenticated authorization downgrade
- CVE-2026-493539Router: Local-Only Access Gate Bypass in 9router via Host Header SpoofING
- CVE-2026-493529Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass
- CVE-2026-463399Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
- CVE-2026-623289Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints
- CVE-2026-623279Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats
- CVE-2026-598019Router 0.4.41 - Unauthenticated API Exposure via /api/providers
- CVE-2026-566759router: Reverse proxy locality collapse allows unauthenticated access to 9router /v1 APIs
- CVE-2026-556389router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass
- CVE-2026-556419router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF
- CVE-2026-566769router: Image prefetch DNS rebinding allows SSRF to internal services
- CVE-2026-555009router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover
- CVE-2026-555019router: Login brute-force protection bypass via spoofed X-Forwarded-For header
- CVE-2026-598009Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint
- CVE-2026-10269decolua 9router HTTP Header dashboardGuard.js isAuthenticated improper authorization
- CVE-2026-5842decolua 9router Administrative API Endpoint api authorization