CVE-2026-72815

A flaw was found in the go-chi chi RealIP middleware. This vulnerability allows a remote attacker to spoof their IP address by manipulating the X-Forwarded-For HTTP header. By exploiting this, an attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, potentially leading to unauthorized access or misattribution of actions.

An IP spoofing flaw exists in go-chi/chi's RealIP middleware. When parsing incoming HTTP requests, the middleware blindly trusts the leftmost IP address in the X-Forwarded-For header without verifying proxy chain trust. Remote unauthenticated attackers can supply arbitrary client IP addresses to bypass IP-based access control lists (ACLs), evade rate-limiting rules, or forge audit trail logs, posing a Low impact to confidentiality and integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not rely on the RealIP middleware when accepting connections from untrusted networks. Instead, configure an upstream reverse proxy (such as NGINX or HAProxy) to overwrite or sanitize client-supplied X-Forwarded-For headers before forwarding traffic to the application.