CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-59800 — 9Router before 0.4.44 contains an OS command injection vulnerability in the unau...

·Source: NIST NVD

Updated:

Executive Summary

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs

Analysis

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC). CVSS Score: 9.8. Published: 2026-07-07T19:16:55.260.

Indicators of Compromise (1)

CVE (1)
CVE-2026-59800
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 7, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerability

NVD CRITICAL: CVE-2026-59706 — mem0 contains unauthenticated config API endpoints that expose LLM API keys in p...

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses like cloud IMDS via PUT /api/v1/config/mem0/llm en

CVE-2026-59706
NIST NVD
MEDIUMVulnerability

Spain arrests suspected hacker linked to Russian hacktivist campaign

Authorities didn’t name the man or file formal charges, but accuse him of participating in attacks linked to Cyber Army of Russia Reborn and NoName. The post Spain arrests suspected hacker linked to Russian hacktivist campaign appeared first on CyberScoop .

CyberScoop
HIGHVulnerability

NVD HIGH: CVE-2026-59707 — LocalAI contains an unauthenticated server-side request forgery vulnerability in...

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges w

CVE-2026-59707
NIST NVD