9router: Image prefetch DNS rebinding allows SSRF to internal services

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.

Source published

10 Jul 2026 15:30:49 UTC

Source modified

13 Jul 2026 18:11:54 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.

Source published

Jul 10, 2026, 3:30:49 PM (timezone not stated)

Source modified

Jul 13, 2026, 6:11:54 PM (timezone not stated)

Observed here

7 Nov 2026 12:36:31 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 3.1 · 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolving the host before fetching, but open-sse/translator/concerns/image.js performs the later server-side image fetch with a separate DNS resolution. An authenticated attacker with access to the LLM proxy can use a vision-capable model and an attacker-controlled DNS name that first resolves to a public IP and then rebinds to an internal address, allowing server-side requests to internal-only HTTP services. This issue is fixed in version 0.5.2.

Source published

10 Jul 2026 16:16:34 UTC

Source modified

25 Oct 2026 15:10:00 UTC

Observed here

27 Oct 2026 15:15:18 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

## Summary 9router validates image URLs by resolving the host before fetching, but the later server-side fetch performs a separate DNS resolution. An attacker-controlled DNS name can resolve to a public IP during validation and then rebind to an internal Docker/private IP during the fetch. This allows the server-side image prefetch to reach internal-only HTTP services (SSRF). ## Details - **Affected version / commit:** 9router `v0.4.80` @ `b282f05`. - **Reachable through** `/v1/chat/completions` with a **vision-capable model** and an `image_url` content part. A vision-capable model name is required so the image survives modality stripping and the server-side prefetch is armed. - The provider used in this reproduction is the bundled **mock provider** — **no real API key and no real provider call**. - **internal-admin** (the SSRF target) is **not exposed to the host network**; it is reachable only from inside the Docker network. - **rebind-dns** behaviour for `rebind.9r.test`: - first A response → `1.1.1.1` (public) to pass the public-host guard, - second A response → `172.29.0.10` (internal-admin) during the fetch. - **internal-admin** logs `GET /ssrf-marker` with `peer=172.29.0.30` (the `proxied-router` container), proving the server-side fetch landed on the internal service. - **mock-provider** receives `POST /api/chat` and the flow completes with `HTTP 200`. - **Root cause:** DNS TOCTOU — the IP is **not pinned** between the validation resolution (the public-host guard) and the fetch resolution. The guard and the fetch each resolve the hostname independently, so a TTL-0 rebinding authority can return a public IP to the guard and an internal IP to the fetch. ## Proof of Concept This repository is a self-contained Docker Compose reproduction. No real provider is called and no real API key is required. 1. Build and start the stack: ```bash docker compose up --build ``` 2. Confirm `internal-admin` is unreachable from the host: ```bash curl -i http://127.0.0.1:18083/ssrf-marker # connection refused / fail docker compose ps # internal-admin has NO host port mapping ``` 3. Send the request named **`POST image-prefetch DNS rebinding trigger`** from [`requests.http`](./requests.http), or with curl: ```bash curl -i -X POST http://127.0.0.1:18082/v1/chat/completions \ -H "Content-Type: application/json" \ -d '{ "model": "ollama-local/gemma3", "messages": [{"role":"user","content":[ {"type":"text","text":"reproduction image-prefetch trigger"}, {"type":"image_url","image_url":{"url":"http://rebind.9r.test:8080/ssrf-marker?case=rebind-trigger"}} ]}], "stream": false }' ``` ## Impact - SSRF to internal HTTP services reachable from the 9router host/container. - Depending on the environment, this can reach cloud metadata endpoints, internal admin panels, or be used for internal service discovery. - Blind / semi-blind SSRF when the fetched response is not returned to the attacker; an exfil variant (pointing the image at an internal endpoint that returns valid image bytes) can return internal content base64-encoded to the upstream. - Requires a code path that prefetches/normalizes remote images for vision-capable providers. - No real credential is needed for the reproduction. ## Suggested Fix - **Pin the resolved IP** after validation and connect to **that** IP (resolve once, then reuse the address for the fetch). - Block private, loopback, link-local, multicast, and cloud-metadata ranges **at connect time**, not only at validation time. - Perform DNS resolution and IP checks immediately before the request and against the address actually used to connect. - Disable redirects, or re-validate every redirect target with the same checks. - Enforce an allowlist for image-fetch domains where feasible. - Add a timeout, a response size limit, and a content-type check.

Source published

23 Sep 2026 18:12:28 UTC

Source modified

23 Sep 2026 18:27:56 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Publisher rating · HIGH