Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-55500.
Upgrade to ProDetect 9router (npm) Unprotected Database Import/Export Leading to Credential Theft and Database Takeover (CVE-2026-55500) in Microsoft Sentinel
CVE-2026-55500 affects the 9router npm package (<= 0.4.71), which exposes an unauthenticated/improperly-protected database import/export interface. Attackers can invoke this exposed functionality to exfiltrate the entire application database — including credentials, session tokens, and configuration secrets — or import a malicious database to achieve full application takeover. CVSS 9.9, CWE-200 (Exposure of Sensitive Information). A public PoC/advisory exists (GHSA-qvfm-67h2-2qfx). Detections focus on anomalous HTTP requests to database export/import endpoints, bulk data egress, unauthenticated administrative API access, and post-exploitation credential misuse.
MITRE ATT&CK
KQL Detection Query
let ExportPaths = dynamic(["/api/export","/api/db/export","/api/database/export","/api/import","/api/db/import","/api/backup","/api/backup/download"]);
let SuspiciousAgents = dynamic(["curl","python-requests","Go-http-client","HTTPie","axios"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsUriStem has_any (ExportPaths)
| extend HasAuthHeader = tostring(parse_json(Cookie))
| where isempty(HasAuthHeader) or UserAgent has_any (SuspiciousAgents)
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Paths = make_set(CsUriStem), Agents = make_set(UserAgent) by CIp
| where RequestCount >= 1
| project CIp, RequestCount, FirstSeen, LastSeen, Paths, AgentsDetects requests to 9router database export/import endpoints without authentication cookies or from scripted/automation user agents, indicative of exploitation of CVE-2026-55500.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate scheduled database backup jobs from internal automation using scripted user agents
- Authorized admin exports performed via CLI/curl by operations staff
- Monitoring/health-check tools polling similar path names for unrelated services
Other platforms for CVE-2026-55500
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Unauthenticated Database Export Request
Expected signal: Web server access log entry showing GET/POST to /api/db/export with no Authorization or session cookie header, response status 200 and non-trivial body size.
- Test 2Simulate Unauthorized Database Import
Expected signal: Web server log entry for POST to /api/db/import with multipart file upload and no auth header; application log showing database write/replace event.
- Test 3Scripted Reconnaissance of Export/Import/Backup Endpoints
Expected signal: Multiple sequential unauthenticated HTTP requests from a single source IP to distinct export/import/backup paths within a short time window, with a scripted (non-browser) User-Agent.
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-55500 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month