CVE-2026-59800: 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard

criticalCVSS 9.8CVE-2026-59800

9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword field from the request body is written to the stdin of a 'sudo -S sh' child process. When sudo does not prompt for a password (the process runs as root, NOPASSWD is configured, or a recent sudo timestamp cache exists), the sudoPassword value is interpreted by sh as a shell command, allowing a remote unauthenticated attacker to execute arbitrary OS commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-07-04 (UTC).

Details

Source: NVD Recent CVEs (US · database · site)
Severity: critical — CVSS 9.8
Published: 2026-07-07
Last updated: 2026-07-10
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-59800

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-598001.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 69% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-59800	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalGHSA-g6g7-pvmx-m74p: 9router: Missing Authorization and OS Command Injectionghsa

Recent advisories for 9Router

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

highCVE-2026-56675: 9Router is an AI router & token saver. Prior to 0.5.2, 9router treats loopback requests as tru…nvd · 2026-07-10
highCVE-2026-55641: 9Router is an AI router & token saver. Prior to 0.5.2, 9router determines whether a /v1 LLM pr…nvd · 2026-07-10
highCVE-2026-55638: 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1,…nvd · 2026-07-10
highCVE-2026-56676: 9Router is an AI router & token saver. Prior to 0.5.2, 9router validates image URLs by resolvi…nvd · 2026-07-10
highCVE-2026-55501: 9Router is an AI router & token saver. Prior to 0.4.80, the dashboard login rate limiter in sr…nvd · 2026-07-10
criticalCVE-2026-55500: 9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint al…nvd · 2026-07-10