9Router 0.4.30–0.4.37 unauthorized MCP command execution vulnerability (CVE-2026-46339) actively exploited

In 9Router versions 0.4.30 through 0.4.37, the src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing attackers to register customPlugins without authorization via the cowork-settings route and execute commands through the MCP bridge; the vulnerability was fixed in 0.4.37. Over 30 days, huntback's network captured 362 exploitation attempts involving 312 distinct source IPs, with the most recent on 2026-10-07.