CVE-2026-63313

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-63313
9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.1 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825
https://www.vulncheck.com/advisories/9router-before-server-side-request-forgery-via-v1-web-fetch
https://github.com/decolua/9router/security/advisories/GHSA-qj3v-64wj-q825
Configurations

No configuration.

History

24 Oct 2026, 13:10

Type Values Removed Values Added
Summary
  • (es) 9Router anterior a 0.4.72 contiene una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) en el endpoint /v1/web/fetch. El endpoint acepta un parámetro url controlado por el usuario y lo pasa a un proveedor de scraping externo configurado (Firecrawl, Jina Reader, Tavily o Exa) para obtener contenido. La URL solo se valida como sintácticamente válida a través de new URL() sin una lista de bloqueo para rangos de IP privados, endpoints de metadatos de la nube (p. ej., 169.254.169.254), direcciones link-local o nombres de host internos. Un usuario autenticado o conectado localmente puede hacer que el servidor obtenga URLs internas arbitrarias y que se devuelva el contenido de la respuesta, lo que permite un SSRF de acceso de lectura que puede exponer credenciales de metadatos de la nube, alcanzar servicios internos y eludir la autenticación en endpoints de localhost.
Information

Published : 2026-07-23 22:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-63313

Mitre link : CVE-2026-63313

CVE.ORG link : CVE-2026-63313

JSON object : View

Products Affected

No product.

CWE
CWE-918

Server-Side Request Forgery (SSRF)