CVE-2026-118651

A flaw was found in Echo. When the proxy middleware is used without an explicit IP extractor configured, it retains and forwards attacker-supplied X-Real-IP headers to upstream services. A remote attacker can exploit this vulnerability to spoof their client Internet Protocol IP address. This flaw...

CVE-2026-118265

A flaw was found in the Echo web framework. A remote attacker can spoof their client Internet Protocol IP address by sending a crafted request with an arbitrary X-Real-IP header, such as an internal or loopback address. Because the framework checks whether the header value itself falls within a...

9router <=0.5.4 - Authentication Bypass

9Router prior to 0.5.6 contains an authentication bypass caused by trusting client-supplied X-9r-Real-Ip header in src/dashboardGuard.js, letting remote unauthenticated attackers access local API routes and consume resources, exploit requires bypassing API-key validation via header manipulation...

CVE-2026-77463

The Remark42 self-hosted comment engine (versions 1.0.0 to 1.16.2 ) is vulnerable to a rate limit bypass due to the unconditional trust of True-Client-IP , X-Real-IP , and X-Forwarded-For headers. Because the software fails to verify that the direct peer is a trusted proxy, and the middleware.Rea...

CVE-2026-102895

Prior to version 2.2.0 , GPUStack (an open-source GPU cluster manager) is vulnerable to an authentication bypass due to improper origin validation in gpustack/api/auth.py. The get_current_user function treated requests appearing to originate from a loopback source (127.0.0.1) as the built-in admi...

CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, getcurrentuser in gpustack/api/auth.py treated a loopback request source as the built-in administrator when forceauthlocalhost was false, which was the default. A remote request coul...

CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, getcurrentuser in gpustack/api/auth.py treated a loopback request source as the built-in administrator when forceauthlocalhost was false, which was the default. A remote request coul...

PT-2026-137174

Name of the Vulnerable Software and Affected Versions GPUStack versions prior to 2.2.0 Description An authentication bypass exists where the get current user function in gpustack/api/auth.py incorrectly treats loopback request sources as the built-in administrator when force auth localhost is set...

CVE-2022-24112

CVE-2022-24112 CVE-2022-24112: Apache APISIX apisix/batch-requests RCE nuclei template: CVE-2022-24112.yaml The essence of this vulnerability is similar to CVE-2021-45232, both bypass authorization or are unauthenticated, to execute malicious filterfunc or script in a route to execute commands...

vaultwarden-ip-header-spoof

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · vaultwarden-ip-header-spoof Write-up: https://abraxaslabs.tech/research/vaultwarden-ip-header-spoof vaultwarden-ip-header-spoof Vaultwarden 1.37.3 - dani-garcia Default IPHEADER=X-Real-IP plus...

CVE-2026-119711

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints,...

CVE-2026-119711 PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints,...

EUVD-2026-114116

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints,...

CVE-2026-119711 PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints,...

CVE-2026-119711

PipesHub versions prior to 0.10.0 are vulnerable to a rate limit bypass due to a flaw in the getClientIp() function. Unauthenticated attackers can evade per-IP throttling by spoofing the X-Forwarded-For or X-Real-IP headers. By rotating these header values, an attacker can obtain fresh rate-limit...

PT-2026-133645

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints,...

CVE-2026-119711: pipeshub-ai: PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated…

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints,...

CVE-2026-118651

Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middleware can preserve an attacker-supplied X-Real-IP header and forward it to an upstream service when Echo.IPExtractor is not configured. A remote client can therefore make upstream services receive a spoofed client address,...

CVE-2026-118653

Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can rotate arbitrary forwarded-address valu...

Echo: X-Real-IP Extractor Trusts The Header Value Instead Of The Sending Peer

Impact In Echo v5, "ExtractIPFromRealIPHeader" checked whether the address supplied in "X-Real-IP" belonged to a trusted range instead of checking the address of the direct network peer. An untrusted client could therefore supply a loopback or private address and have it returned by "c.RealIP" wi...