CVE-2026-72817

A flaw was found in the go-chi/chi component. The RealIP middleware, responsible for resolving the request source IP, does not properly validate trusted proxies when processing the X-Forwarded-For header. A remote attacker can exploit this by prepending a forged IP address to the X-Forwarded-For header, leading to IP spoofing. This could allow the attacker to bypass access controls or falsify request logs.

A flaw in the go-chi/chi RealIP middleware allows remote attackers to spoof source IP addresses (Request.RemoteAddr). The middleware parses the first IP address in the X-Forwarded-For header without verifying if the immediate HTTP proxy peer is trusted. An unauthenticated attacker can prepend an arbitrary IP address to the X-Forwarded-For header, causing applications relying on RealIP for request context to misidentify the client source. This enables bypassing application-level IP-based access control lists (ACLs) or spoofing identity in audit logs.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the default RealIP middleware and replace it with a proxy-aware middleware (such as httputil.ReverseProxy or custom header parsing) that strictly validates upstream reverse proxies against an explicit list of trusted CIDR ranges before accepting X-Forwarded-For headers.