{"items":[{"id":"NVI-00012946","kind":"vulnerability","title":"9router: Image prefetch DNS rebinding allows SSRF to internal services","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-cmhj-wh2f-9cgx","CVE-2026-56676"],"plain_summary":"GitHub lists this reviewed advisory for 9router. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-18305e9436f1dca0c688cd5be208b98a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-23T18:12:29.000Z","value":"7.4 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-18305e9436f1dca0c688cd5be208b98a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-18305e9436f1dca0c688cd5be208b98a","url":"https://github.com/advisories/GHSA-cmhj-wh2f-9cgx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-cmhj-wh2f-9cgx","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:25:10.521Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-18305e9436f1dca0c688cd5be208b98a"],"technology":"9router","known_exclusions":[],"conditions_summary":"## Summary\n\n9router validates image URLs by resolving the host before fetching, but the later\nserver-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can\nresolve to a public IP during validation and then rebind to an internal Docker/private IP\nduring the fetch. This allows the server-side image prefetch to reach internal-only HTTP\nservices (SSRF).\n\n## Details\n\n- **Affected version / commit:** 9router `v0.4.80` @ `b282f05`.\n- **Reachable through** `/v1/chat/completions` with a **vision-capable model** and an\n  `image_url` content part. A vision-capable model name is required so the image survives\n  modality stripping and the server-side prefetch is armed.\n- The provider used in this reproduction is the bundled **mock provider** — **no real API\n  key and no real provider call**.\n- **internal-admin** (the SSRF target) is **not exposed to the host network**; it is\n  reachable only from inside the Docker network.\n- **rebind-dns** behaviour for `rebind.9r.test`:\n  - first A response → `1.1.1.1` (public) to pass the public-host guard,\n  - second A response → `172.29.0.10` (internal-admin) during the fetch.\n- **internal-admin** logs `GET /ssrf-marker` with `pe","public_affected_ranges":["<= 0.4.80"]}],"null_published_at":"2026-11-01T07:29:12.904Z","source_updated_at":"2026-09-23T18:12:29.000Z","source_disclosed_at":"2026-09-23T18:12:28.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:25:10.521Z"}],"next_cursor":null,"snapshot_revision":"42594"}