MEDIUM 6.4 GitHub
CVE-2026-56678
9router: Kiro region injection allows authenticated SSRF with Authorization header forwarding
### Summary
The Kiro API-key validation endpoint builds an upstream URL using a user-controlled
`region` value. By supplying a crafted region such as `kiro-canary.local:8443#`, an
authenticated attacker can cause 9router to send the Kiro validation request to an
attacker-controlled host under the constructed `codewhisperer.<region>` hostname. The
request forwards the submitted Kiro API key as an `Authorization: Bearer` header.
### Details
- **Affected version / commit:** 9router v0.5.2 @ `5da
Affected Products
- npm/9router <= 0.5.2
References
- https://github.com/advisories/GHSA-6mwv-4mrm-5p3m
- https://github.com/decolua/9router/security/advisories/GHSA-6mwv-4mrm-5p3m
- https://nvd.nist.gov/vuln/detail/CVE-2026-56678
- https://github.com/decolua/9router/commit/126aa244c5b51b74ab8c7594e3418fcf4437bf6f
This medium severity vulnerability with a CVSS score of 6.4 was published on 2026-09-23 via GitHub. Affected: npm/9router <= 0.5.2.
vulnfeed aggregates 12908 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.