9router CVE-2026-72860

Default configuration requires a valid 9router dashboard session (PR:L); if the requireLogin setting is disabled, no authentication is required and exploitation is open to any network-reachable caller. The vulnerable endpoint is POST /api/provider-nodes/validate, which must not be blocked by an intermediary control such as a WAF or API gateway. The partial response disclosure path (200-byte truncation) is triggered only when the custom-embedding validation type is invoked and the internal service returns a non-2xx, non-401, non-403 status; other validation types remain usable for blind port scanning via status codes and timing. The DNS-hostname bypass (a named host resolving to an internal IP) requires that no egress DNS filtering or firewall prevents outbound connections from the 9router host. No user interaction, no client-side component, and no non-default server configuration beyond disabling requireLogin are needed for the primary IPv6-mapped bypass.

The CVSS 3.1 score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) accurately reflects the network-accessible exploitation surface, low attack complexity, and changed scope reaching internal infrastructure. The PR:L rating is correct for the default configuration requiring a dashboard session; if requireLogin is disabled, the effective privilege requirement drops to PR:N, raising real-world risk substantially beyond the scored value. No EPSS score or CISA KEV listing appears in the available intelligence, meaning no confirmed active exploitation exists at time of analysis. However, the bypass is mechanically trivial once understood - the full technique is derivable from the publicly available fix PR diff (#3370) and the detailed GitHub issue (#3293) without additional reverse engineering. The partial response disclosure (200-byte truncation on error status codes) and blind port-scanning capability via status and timing differences add concrete post-SSRF utility beyond theoretical access. A residual DNS-rebinding gap acknowledged in the PR comment means that even after the IPv6 fix is applied, the guard remains bypassable via hostname-to-internal-IP resolution - defenders operating any version of this product should layer egress firewall controls regardless of patch status.

An attacker holding a valid 9router dashboard session sends POST /api/provider-nodes/validate with baseUrl set to http://[::ffff:a9fe:a9fe]/latest/meta-data/ (the AWS EC2 instance metadata endpoint encoded as an IPv4-mapped IPv6 address in WHATWG-canonicalized hextet form). The SSRF guard's regex fails to match the canonicalized hostname, the application issues the request server-side, and the first 200 bytes of the metadata response are returned to the attacker via the custom-embedding error path. No public exploit code has been identified, but the technique is fully derivable from the public fix PR diff and issue discussion.