Summary
9router: Image prefetch DNS rebinding allows SSRF to internal services
9router validates image URLs by resolving the host before fetching, but the later
server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can
resolve to a public IP during validation and then rebind to an internal Docker/private IP
during the fetch. This allows the server-side image prefetch to reach internal-only HTTP
services (SSRF).
Details
- Affected version / commit: 9router
v0.4.80@b282f05. - Reachable through
/v1/chat/completionswith a vision-capable model and animage_urlcontent part. A vision-capable model name is required so the image survives
modality stripping and the server-side prefetch is armed. - The provider used in this reproduction is the bundled mock provider, no real API
key and no real provider call. - internal-admin (the SSRF target) is not exposed to the host network; it is
reachable only from inside the Docker network. - rebind-dns behaviour for
rebind.9r.test:- first A response →
1.1.1.1(public) to pass the public-host guard, - second A response →
172.29.0.10(internal-admin) during the fetch.
- first A response →
- internal-admin logs
GET /ssrf-markerwithpeer=172.29.0.30(theproxied-router
container), proving the server-side fetch landed on the internal service. - mock-provider receives
POST /api/chatand the flow completes withHTTP 200. - Root cause: DNS TOCTOU, the IP is not pinned between the validation resolution
(the public-host guard) and the fetch resolution. The guard and the fetch each resolve the
hostname independently, so a TTL-0 rebinding authority can return a public IP to the guard
and an internal IP to the fetch.
Proof of Concept
This repository is a self-contained Docker Compose reproduction. No real provider is called
and no real API key is required.
- Build and start the stack:
docker compose up --build - Confirm
internal-adminis unreachable from the host:curl -i http://127.0.0.1:18083/ssrf-marker # connection refused / fail docker compose ps # internal-admin has NO host port mapping - Send the request named
POST image-prefetch DNS rebinding triggerfromrequests.http, or with curl:curl -i -X POST http://127.0.0.1:18082/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{ "model": "ollama-local/gemma3", "messages": [{"role":"user","content":[ {"type":"text","text":"reproduction image-prefetch trigger"}, {"type":"image_url","image_url":{"url":"http://rebind.9r.test:8080/ssrf-marker?case=rebind-trigger"}} ]}], "stream": false }'
Impact
- SSRF to internal HTTP services reachable from the 9router host/container.
- Depending on the environment, this can reach cloud metadata endpoints, internal admin
panels, or be used for internal service discovery. - Blind / semi-blind SSRF when the fetched response is not returned to the attacker; an
exfil variant (pointing the image at an internal endpoint that returns valid image bytes)
can return internal content base64-encoded to the upstream. - Requires a code path that prefetches/normalizes remote images for vision-capable
providers. - No real credential is needed for the reproduction.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
CVE-2026-56676 has a CVSS score of 7.4 (High). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.5.2); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
- Pin the resolved IP after validation and connect to that IP (resolve once, then
reuse the address for the fetch). - Block private, loopback, link-local, multicast, and cloud-metadata ranges at connect
time, not only at validation time. - Perform DNS resolution and IP checks immediately before the request and against the
address actually used to connect. - Disable redirects, or re-validate every redirect target with the same checks.
- Enforce an allowlist for image-fetch domains where feasible.
- Add a timeout, a response size limit, and a content-type check.
Frequently Asked Questions
- What is CVE-2026-56676? CVE-2026-56676 is a high-severity server-side request forgery (SSRF) vulnerability in 9router (npm), affecting versions <= 0.4.80. It is fixed in 0.5.2. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
- How severe is CVE-2026-56676? CVE-2026-56676 has a CVSS score of 7.4 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of 9router are affected by CVE-2026-56676? 9router (npm) versions <= 0.4.80 is affected.
- Is there a fix for CVE-2026-56676? Yes. CVE-2026-56676 is fixed in 0.5.2. Upgrade to this version or later.
- Is CVE-2026-56676 exploitable, and should I be worried? Whether CVE-2026-56676 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-56676 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-56676? Upgrade
9routerto 0.5.2 or later.