9router MCP Plugin Registration RCE Chain (Default Credential + Host Header Bypass)
First seen Jul 25, 2026 · Updated Jul 25, 2026 · CVSS 9.9
9router versions up to 0.4.59 contain a chained vulnerability allowing a remote, unauthenticated attacker to gain full control of the host system. By logging in with a hardcoded default password, spoofing the Host header to bypass local-only network restrictions, and registering a malicious MCP plugin, an attacker can achieve arbitrary code execution. This is fixed in version 0.4.60 and should be patched immediately given the ease of exploitation and severity.
Technical Analysis
The vulnerability chain begins with a hardcoded default credential (password '123456') present on fresh 9router installations, allowing trivial unauthenticated login. Attackers then bypass the LOCAL_ONLY network gate intended to restrict sensitive routes to local traffic by spoofing the Host header, exposing internal-only administrative endpoints to remote access. The critical escalation point is unvalidated argument handling in child_process.spawn() during MCP (Model Context Protocol) plugin registration, permitting injection of arbitrary shell commands (e.g., 'node -e <payload>') that execute when the plugin's SSE endpoint is triggered. This results in full arbitrary code execution on the underlying host OS with no authentication barrier beyond the default credential. Because 9router operates as MCP plugin infrastructure commonly used to extend AI agent tool-use capabilities, this vulnerability directly threatens AI agent deployments by allowing attackers to hijack the host running agent orchestration, exfiltrate API keys/credentials used by agents, or pivot to poison RAG pipelines and tool outputs consumed downstream by LLMs.
Affected Systems
9router version 0.4.59 and earlier; fresh/default installations that have not changed the default password; deployments relying on LOCAL_ONLY network restrictions without additional Host header validation; any host running MCP plugin registration via child_process.spawn(). Fixed in version 0.4.60.
Indicators of Compromise
- Default credential login attempt: username with password '123456'
- Spoofed Host header values targeting LOCAL_ONLY-gated endpoints
- MCP plugin registration payloads containing 'node -e' command execution strings
- Unexpected child_process.spawn() invocations from MCP plugin registration handlers
- Anomalous SSE endpoint triggers correlating with new/unrecognized MCP plugin registrations
Remediation Steps
- 1
Upgrade to 9router 0.4.60
Apply the vendor patch immediately, which fixes the default credential, Host header bypass, and child_process.spawn() argument validation issues.
- 2
Rotate default credentials
On any existing installation, immediately change the default password from '123456' to a strong, unique credential, especially on internet-facing instances.
- 3
Audit MCP plugin registrations
Review all currently registered MCP plugins for unauthorized or suspicious entries, particularly those invoking shell commands or scripting interpreters.
- 4
Restrict network exposure
Do not rely solely on Host-header-based LOCAL_ONLY gating; enforce network-level segmentation (firewall rules, reverse proxy validation) to prevent external access to administrative routes.
- 5
Monitor for anomalous process spawning
Deploy host-based monitoring/EDR to detect and alert on unexpected child_process.spawn() calls originating from the 9router service.
- 6
Rotate exposed secrets
If compromise is suspected, rotate all API keys, tokens, and credentials accessible to agents or tools running on the affected host.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.