9Router Unauthenticated OS Command Injection via Tailscale Install Endpoint
First seen Jul 8, 2026 · Updated Jul 8, 2026 · CVSS 9.8
9Router, a platform used to manage/orchestrate agent-related infrastructure, has a critical unauthenticated remote code execution flaw in its tunnel installation endpoint. An attacker can send a crafted 'sudoPassword' field that gets fed directly into a shell process, resulting in arbitrary OS command execution as root in many configurations. This is a classic infrastructure vulnerability with severe impact, already showing exploitation evidence in the wild.
Technical Analysis
The vulnerability arises because the POST /api/tunnel/tailscale-install route is excluded from the dashboard's authorization middleware matcher, leaving it fully unauthenticated. The server takes the attacker-controlled 'sudoPassword' field and writes it verbatim to the stdin of a 'sudo -S sh' child process without sanitization. If sudo does not actually prompt for a password (root context, NOPASSWD policy, or cached timestamp), the supplied string is instead executed by the underlying 'sh' shell, giving the attacker full command execution privileges. Because 9Router likely underpins agent orchestration or tunnel management for AI agent deployments, compromise of this endpoint could allow lateral movement into agent runtimes, credential theft, or manipulation of agent configurations and tool registries, effectively crossing from an infrastructure-layer bug into the agent trust boundary.
Affected Systems
9Router
Detection Signatures
- POST requests to /api/tunnel/tailscale-install without authentication headers
- sudoPassword field containing shell metacharacters (;, |, &&, $(), backticks, newline)
- Unexpected child processes spawned from 'sudo -S sh' with non-password stdin content
- Spikes in outbound connections or new processes following Tailscale install API calls
- Shadowserver Foundation scanning/exploitation reports referencing CVE-2026-59800
Remediation Steps
- 1
Upgrade 9Router
Update to version 0.4.44 or later where the authorization middleware matcher covers this endpoint and input handling is fixed.
- 2
Restrict endpoint access
Until patched, block or firewall the /api/tunnel/tailscale-install route at the network/reverse-proxy layer to prevent unauthenticated access.
- 3
Harden sudo configuration
Avoid NOPASSWD sudo policies and reduce sudo timestamp cache duration to minimize conditions where injected input is executed as a command instead of a password prompt.
- 4
Input validation
Ensure any field passed to a shell process is never sent to stdin unsanitized; use safe subprocess APIs that avoid shell interpretation entirely (e.g., execve with argument arrays, not shell strings).
- 5
Monitor and patch validate
Use IOC/log detection for anomalous access to this endpoint and validate patch deployment via vulnerability scanning; review Shadowserver telemetry for prior compromise indicators.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.