CriticalPublic exploit

Unauthenticated OS Command Injection in 9Router tailscale-install Endpoint

IdentifiersCVE-2026-59800CWE-78· Improper Neutralization of Special…

CVE-2026-59800 is an OS command injection vulnerability in decolua 9Router before version 0.4.44. The flaw is present in the unauthenticated POST /api/tunnel/tailscale-install endpoint, which is not protected by the dashboard middleware matcher and therefore lacks an authorization check. The vulnerable code writes the sudoPassword field from the request body to the standard input of a child process invoked as 'sudo -S sh'. When sudo does not prompt for a password—such as when the process is already running as root, sudo is configured with NOPASSWD, or a valid sudo timestamp cache exists—the supplied sudoPassword value is consumed by sh as shell input rather than as a password, enabling arbitrary operating system command execution. The issue is remotely reachable without authentication and has been observed exploited in the wild.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote unauthenticated attacker to execute arbitrary OS commands on the host running 9Router. In deployments where the application runs as root, this can result in immediate remote root code execution. In deployments where sudo can be used without an interactive password prompt, the attacker can obtain code execution in the context available to the invoked shell and may be able to escalate privileges depending on sudo policy. The vulnerability can lead to full compromise of confidentiality, integrity, and availability of the affected system.

Mitigation

If you can’t patch tonight, do this now.

Until patching is completed, prevent untrusted network access to affected 9Router instances, especially the tunnel-management routes, by using firewall rules, reverse-proxy access controls, or other network ACLs. Run the service as a non-root user, avoid sudo configurations that permit passwordless execution, and ensure no reusable sudo timestamp cache is present for the service context. If operationally feasible, disable or block the Tailscale installation functionality until the fixed version is deployed.

Remediation

Patch, then assume compromise.

Upgrade 9Router to version 0.4.44 or later. The fixed release removes the vulnerable behavior affecting versions prior to 0.4.44. After upgrading, verify that the vulnerable endpoint is no longer reachable without authorization and review any custom integrations or local modifications that may preserve the unsafe command execution pattern.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

9Router9Routerapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

cvefeed high severityNews

Jul 7, 2026

CVE-2026-59800 - 9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint

A remote unauthenticated OS command injection vulnerability in 9Router before version 0.4.44, affecting the POST /api/tunnel/tailscale-install endpoint and enabling arbitrary command execution under certain sudo conditions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity5