CVE-2026-55638 decolua CVE debrief

Who should care

Users of 9Router AI router & token saver, particularly those with operator-stored LLM provider credentials, should be aware of this vulnerability and take steps to defend against it. Affected operators, platforms, and security teams should review exposure and prioritize remediation. This may involve coordinating with vendors, updating affected systems, and monitoring for suspicious activity.

Technical summary

Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before next.config.mjs rewrites /codex/* to /api/v1/responses. A remote unauthenticated attacker can send requests to /codex/* to bypass the API-key gate and cause the server to make upstream provider calls using operator-stored LLM provider credentials. Defenders should focus on restricting access and monitoring for suspicious activity. This may involve reviewing system configurations, implementing additional security controls, and verifying vendor guidance.

Defensive priority

High

Recommended defensive actions

• Upgrade to version 0.5.2 or later
• Restrict access to /codex/*
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record was published on 2026-07-10T17:16:59.183Z and was last modified on 2026-07-10T17:35:11.103Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected product scope, vendor guidance, and potential exposure with minimal assumptions. Additional verification steps may include reviewing system configurations, monitoring for suspicious activity, and confirming vendor advisories.

Official resources