CVE-2026-56676: 9Router SSRF Vulnerability

CVE-2026-56676 Overview

CVE-2026-56676 is a Server-Side Request Forgery (SSRF) vulnerability in 9Router, an AI router and token saver, affecting versions prior to 0.5.2. The flaw arises from a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-367] between DNS validation and image fetching. 9Router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the Large Language Model (LLM) proxy can abuse a vision-capable model with an attacker-controlled DNS name to reach internal-only HTTP services. The issue is fixed in version 0.5.2.

Critical Impact
Authenticated attackers can bypass SSRF protections through DNS rebinding, enabling server-side requests to internal HTTP services that should not be reachable from the LLM proxy.

Affected Products

9Router versions prior to 0.5.2
Deployments exposing vision-capable models through the LLM proxy
Instances using open-sse/translator/concerns/image.js for image handling

Discovery Timeline

2026-07-10 - CVE-2026-56676 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-56676

Vulnerability Analysis

The vulnerability is a classic DNS rebinding SSRF caused by a TOCTOU flaw in how 9Router validates and then fetches remote images. When a user submits an image URL to a vision-capable model, 9Router first resolves the hostname and checks whether the resulting IP address is public and permitted. The server then issues a separate outbound fetch to the same hostname, triggering a second DNS lookup. An attacker who controls the authoritative DNS server for the hostname can return a public IP on the first lookup and an internal RFC1918 or loopback address on the second lookup. This lets attacker-supplied requests reach services bound to internal interfaces, such as cloud metadata endpoints, internal APIs, or administrative panels not exposed to the internet.

Root Cause

The root cause is the split DNS resolution path between validation and fetch. The host allow-list check and the HTTP fetch both perform independent name resolutions, so the value observed at check time is not guaranteed to match the value used at request time. Attackers with authenticated access to the LLM proxy can weaponize this window by pointing a controlled DNS name with a short Time-To-Live (TTL) at rebinding infrastructure.

Attack Vector

Exploitation requires authenticated access to the LLM proxy and a model that accepts image inputs. The attacker submits an image URL referencing an attacker-controlled domain with a low-TTL DNS record. After the initial validation resolves to a public IP, the record rebinds to an internal address such as 127.0.0.1, 169.254.169.254, or an internal service IP. The subsequent server-side fetch is issued against the internal host, and response content or side-channel timing can be observed through the LLM interaction.

javascript

 }
 
 import { lookup } from "node:dns/promises";
+import { Agent } from "undici";
 import { MAX_IMAGE_BYTES, FETCH_TIMEOUT_MS, IMAGE_SIGNATURES, BLOCKED_HOSTS } from "../../config/mediaConfig.js";
 
 // True if an IPv4/IPv6 address is private/reserved (SSRF target).

Source: GitHub Commit c7d0744. The patch introduces an undiciAgent to pin the DNS-resolved IP used during validation to the socket used during fetch, eliminating the TOCTOU window.

Detection Methods for CVE-2026-56676

Indicators of Compromise

Outbound DNS lookups from the 9Router host that resolve to public IPs followed by internal or reserved IPs within short intervals for the same hostname.
Server-side HTTP requests from the LLM proxy targeting 127.0.0.0/8, 169.254.169.254, or RFC1918 ranges.
Image URLs submitted to vision-capable models referencing domains with unusually low DNS TTLs.

Detection Strategies

Log every hostname-to-IP resolution performed by open-sse/translator/concerns/image.js and alert when a single hostname returns both public and private addresses.
Correlate authenticated LLM proxy sessions with outbound image fetch destinations to surface anomalous internal targets.
Inspect HTTP client egress traffic for connections to link-local, loopback, or private ranges originating from the 9Router process.

Monitoring Recommendations

Enable network-layer egress filtering telemetry and forward flow logs to a centralized analytics platform.
Monitor for repeated image submissions from the same authenticated principal that reference short-TTL domains.
Track version strings of deployed 9Router instances to identify hosts still running versions prior to 0.5.2.

How to Mitigate CVE-2026-56676

Immediate Actions Required

Upgrade 9Router to version 0.5.2 or later, which pins the DNS-resolved IP between validation and fetch.
Restrict LLM proxy accounts and disable vision-capable models for untrusted users until patching is complete.
Block outbound connections from the 9Router host to internal management networks and cloud metadata endpoints at the network layer.

Patch Information

The fix is available in 9Router Release v0.5.2 and the corresponding commit c7d0744. Full remediation details are in GitHub Security Advisory GHSA-cmhj-wh2f-9cgx.

Workarounds

Deploy 9Router behind an egress proxy that enforces an allow-list of external image hosts and blocks all internal address ranges.
Force the HTTP client to connect only to the exact IP address returned by the initial validation lookup.
Disable image ingestion for vision-capable models until the upgrade to 0.5.2 is completed.

bash

# Example egress restriction using iptables to block internal targets from the 9router service user
iptables -A OUTPUT -m owner --uid-owner 9router -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner 9router -d 169.254.0.0/16 -j REJECT