What happened
GitHub Security Advisory GHSA-4922-8r65-fq26 (CVE-2026-63732, CVSS 9.9, published July 23 2026) documents a three-stage vulnerability chain in 9router — a hardcoded default password, a Host-header-based bypass of network access controls, and unsafe argument passing to child_process.spawn() during MCP plugin registration — that together give a remote, unauthenticated attacker full RCE on the host.
Why it matters
9router sits directly in the MCP plugin-registration and dispatch path for agentic tool use; a hardcoded default credential combined with unauthenticated RCE in an MCP tool-registration surface means any exposed instance is trivially and fully compromised, potentially exposing every downstream AI agent tool call routed through it.
Attack vector
A remote unauthenticated attacker logs in using a hardcoded default password (123456) present on any fresh install, spoofs the Host header to bypass the LOCAL_ONLY network gate reaching internal-only routes, then registers a malicious MCP plugin with unvalidated arguments passed to Node's child_process.spawn() (e.g. node -e <payload>), achieving arbitrary code execution when the plugin's SSE endpoint is triggered.
Affected systems
9router 0.4.59 (fixed in 0.4.60)
Mitigation
Upgrade to 9router 0.4.60 or later immediately; change default credentials on any pre-upgrade instance and audit for compromise.