CVE-2026-55500: Unprotected Database Import/Export in 9router (npm) Enables Full Application Takeover

What's Happening

CVE-2026-55500 is a critical exposure vulnerability (CWE-200) in the 9router npm package. The package exposes a database import/export interface that is either unauthenticated or improperly access-controlled. Any attacker who can reach this endpoint can export the entire application database — credentials, session tokens, and configuration secrets included — or push an attacker-controlled import to overwrite application data and achieve full takeover. The vulnerability carries a CVSS score of 9.9, reflecting the combination of trivial exploitability and catastrophic impact.

Affected Software

• Vendor/Ecosystem: npm
• Product: 9router
• Affected Versions: <= 0.4.71

No patched version is currently listed; organizations running affected versions should treat this as unmitigated until a fix is confirmed.

Exploitation Status

A public proof-of-concept and advisory (GHSA-qvfm-67h2-2qfx) is available, meaning working exploitation details are already in the hands of attackers and researchers alike. This is not yet observed in KEV, but public PoC availability significantly lowers the bar for opportunistic exploitation — defenders should prioritize detection and mitigation now rather than waiting for confirmed in-the-wild activity.

How Our Detection Catches It

We ship coverage for CVE-2026-55500 across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). At a high level, the detection logic focuses on:

• Anomalous HTTP requests targeting database export/import endpoints exposed by 9router deployments
• Unauthenticated or unexpected access to administrative API paths tied to the vulnerable functionality
• Bulk data egress patterns consistent with a full database export
• Downstream indicators of post-exploitation credential misuse following a suspected export event

This layered approach lets defenders catch both the initial exposure attempt and the follow-on abuse of stolen credentials, regardless of which SIEM or EDR stack they run.

Get the Full Detection

For the complete KQL, SPL, and other SIEM queries, MITRE ATT&CK mapping, and response guidance, see the full detection page: CVE-2026-55500 detection details.