Local-only access gate bypass — Host header spoofing reaches localhost-restricted endpoints
CVE-2026-49353 is an access-control bypass (CWE-290, authentication bypass by spoofing) in 9router. The router enforces a "local-only" access gate on certain endpoints by inspecting the HTTP Host header to decide whether a request originates locally. Because the Host header is supplied entirely by the client, a remote attacker can set it to a local-looking value and walk straight through the gate.
A local-only gate is meant to answer one question: is this request coming from the machine itself? The only trustworthy signal for that is the transport layer — the real source address of the connection (or a Unix domain socket). 9router instead answered the question with the Host header, an application-layer field that any client can set to anything:
Host: localhost (or 127.0.0.1) is judged "local" and admitted.This is the same structural mistake as trusting X-Forwarded-For for authorization: a value the attacker controls is used as a security boundary.
Remote reach into endpoints that were intended to be available only from the local host. Whatever 9router places behind the local-only gate — typically administrative or otherwise privileged routes that assume a trusted caller — becomes accessible to anyone who can reach the service over the network and send a forged Host header.
Upgrade to the fixed release named in the advisory. The durable fix is to stop trusting client-supplied headers for locality:
Host and strips inbound copies.127.0.0.1 and block external access at the firewall.Reported by Kai Aizen (SnailSploit). Coordinated with the 9router maintainers via GitHub Security Advisory GHSA-6g2f-w7g3-77vf. See the advisory for affected and fixed version details.
An access-control bypass (CWE-290) in 9router. The local-only access gate is enforced by reading the client-supplied HTTP Host header, so a remote attacker who sends Host: localhost passes the gate and reaches endpoints meant to be local-only. Tracked as GHSA-6g2f-w7g3-77vf.
You are affected if you run 9router with endpoints behind its local-only gate and the service is reachable from an untrusted network. See GHSA-6g2f-w7g3-77vf for the affected and fixed version range.
Upgrade to the fixed release in the advisory. Enforce locality on the real connecting peer address or a Unix domain socket — never on the Host header. As interim hardening, bind local-only listeners to 127.0.0.1 and block external access at the firewall.
Remote access to functionality intended to be reachable only from the local host — typically administrative or privileged routes that assume a trusted local caller. The class is an origin/authentication bypass by spoofing.
The GitHub Security Advisory GHSA-6g2f-w7g3-77vf, the MITRE CVE record for CVE-2026-49353, and the NVD detail page once published.