Summary
9router /v1 APIs has unauthenticated access via reverse proxy locality collapse
9router treats local loopback requests as trusted and allows access to /v1/* without an
API key. In a documented/common reverse-proxy deployment where nginx forwards public
traffic to the backend via 127.0.0.1, external non-Origin requests are misclassified as
local. This allows unauthenticated access to /v1 APIs such as /v1/models, and may allow
abuse of configured upstream provider credentials depending on the enabled providers.
Details
- Affected version / commit: 9router
v0.4.80@b282f05. - Deployment precondition: a same-host reverse proxy (e.g. nginx) forwarding public
traffic to the backend on127.0.0.1/localhost. This mirrors the documented cloud
deployment (proxy_pass http://localhost:20128withX-Real-IP/X-Forwarded-For). - Observed behaviour:
- The direct backend (
direct-backend, port18081) returns401for/v1/models
without an API key. - A direct request that spoofs
X-9r-Real-IP: 127.0.0.1still returns401: the
custom server deletes the client-supplied header and overwrites it with the real socket
address, so naive header spoofing does not work against the direct backend. - The proxied path (
reverse-proxy, port18080) returns200with the full model
catalog for the same/v1/modelsrequest without any API key. - A proxied request that carries an
Originheader returns401. The bypass
therefore primarily affects curl / SDK / server-side / non-browser clients, which do
not sendOrigin.
- The direct backend (
- Root cause: the backend's local/remote decision relies on perceived socket/loopback
locality after reverse proxying. Because nginx connects to the backend from127.0.0.1,
the backend stamps a loopback client address for every internet client and treats the
request as local, skipping the/v1API-key requirement. The forwardedX-Real-IP/X-Forwarded-Forheaders that carry the true client IP are ignored for this decision. - This is not a simple client header-spoofing issue (the direct-spoof control above
proves header spoofing is rejected); it is a property of how loopback proxy traffic is
trusted.
Proof of Concept
This repository is a self-contained Docker Compose reproduction. No real provider is called
and no real API key is required.
- Build and start the stack:
docker compose up --build - Direct baseline (no API key):
curl -i http://127.0.0.1:18081/v1/models - Direct spoof control:
curl -i -H "X-9r-Real-IP: 127.0.0.1" http://127.0.0.1:18081/v1/models - Reverse-proxy bypass (no API key):
curl -i http://127.0.0.1:18080/v1/models - Reverse-proxy
Origincontrol:curl -i -H "Origin: http://evil.example" http://127.0.0.1:18080/v1/models
Expected evidence
| Request | Result |
|---|---|
Direct 18081, no key |
401 Unauthorized ({"error":"API key required for remote API access"}) |
Direct 18081, X-9r-Real-IP: 127.0.0.1 spoof |
401 Unauthorized |
Proxied 18080, no key |
200 OK with the full model catalog |
Proxied 18080, with Origin |
401 Unauthorized |
Impact
- Unauthenticated access to the
/v1API surface in the affected reverse-proxy deployment. - Model enumeration via
/v1/models. - Possible abuse of the operator's configured upstream provider credentials through
/v1/chat/completionsand other/v1proxy endpoints (the attacker spends the operator's
provider quota/keys without holding any key of their own). - Actual impact depends on which providers are configured and how the instance is exposed
to the public internet. - The attacker requires no API key.
The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.
CVE-2026-56675 has a CVSS score of 8.3 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.5.2); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Do not use client/proxy/socket IP locality as an authentication bypass.
- Require an API key by default for
/v1/*on public listeners. - If local trust is genuinely needed, bind it to an unguessable server-generated secret or
to a Unix domain socket that is only accessible locally, not to "the connection looks
like loopback". - When running behind reverse proxies, use an explicit trusted-proxy configuration and a
real client-IP derivation (e.g. a vettedX-Forwarded-Forchain), and never treat all
loopback proxy traffic as end-user-local. - Document a secure reverse-proxy configuration for operators.
Frequently Asked Questions
- What is CVE-2026-56675? CVE-2026-56675 is a high-severity improper authentication vulnerability in 9router (npm), affecting versions <= 0.4.80. It is fixed in 0.5.2. The application does not adequately verify the identity of a user, device, or process before granting access.
- How severe is CVE-2026-56675? CVE-2026-56675 has a CVSS score of 8.3 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of 9router are affected by CVE-2026-56675? 9router (npm) versions <= 0.4.80 is affected.
- Is there a fix for CVE-2026-56675? Yes. CVE-2026-56675 is fixed in 0.5.2. Upgrade to this version or later.
- Is CVE-2026-56675 exploitable, and should I be worried? Whether CVE-2026-56675 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-56675 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-56675? Upgrade
9routerto 0.5.2 or later.