CVE-2026-72816

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

Summary

realip middleware in go-chi/chi trusts headers like x-forwarded-for without checking them, so attackers can fake their ip and bypass rate limits or access controls

Details

the vuln is in middleware/realip.go , the realIP() function pulls IPs straight from client headers and replaces r.RemoteAddr without checking if the request came from a trusted proxy

func realIP(r *http.Request) string {
    var ip string
    if tcip := r.Header.Get(trueClientIP); tcip != "" {
        ip = tcip  // controlled by attacker
    } else if xrip := r.Header.Get(xRealIP); xrip != "" {
        ip = xrip  // controlled by attacker
    } else if xff := r.Header.Get(xForwardedFor); xff != "" {
        ip, _, _ = strings.Cut(xff, ",")  // controlled by attacker
    }
    // ...
    return ip
}

no trusted proxy cidr check in place, any client can send these headers

PoC

create a server with chi and use realip middleware

package main

import (
    "fmt"
    "net/http"
    "github.com/go-chi/chi/v5"
    "github.com/go-chi/chi/v5/middleware"
)

func main() {
    r := chi.NewRouter()
    r.Use(middleware.RealIP)

    r.Get("/admin", func(w http.ResponseWriter, r *http.Request) {
        // ip-based access control got bypassed
        if r.RemoteAddr == "127.0.0.1" {
            w.Write([]byte("SECRET ADMIN DATA"))
            return
        }
        http.Error(w, "Forbidden", 403)
    })

    http.ListenAndServe(":8080", r)
}

spoofed the ip to bypass access control

curl -H "X-Forwarded-For: 127.0.0.1" http://localhost:8080/admin

Impact

• ip-based access control bypass lets attackers reach restricted endpoints
• rate limiting bypass lets attackers avoid limits by rotating spoofed ips
• audit logs show fake ips picked by attacker instead of real ones
• attackers can get around geo ip restrictions

Remediation Recommendation

validate proxy cidr first before trusting forwarded ip headers

// add your reverse proxy ip addresses here
var trustedProxies = []net.IPNet{
       {IP: net.ParseIP("10.0.0.0"), Mask: net.CIDRMask(8, 32)},
    {IP: net.ParseIP("172.16.0.0"), Mask: net.CIDRMask(12, 32)},
    {IP: net.ParseIP("192.168.0.0"), Mask: net.CIDRMask(16, 32)},
}

func isTrustedProxy(ip net.IP) bool {
    for _, cidr := range trustedProxies {
        if cidr.Contains(ip) {
            return true
        }
    }
    return false
}

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi

This update for trivy fixes the following issue:

• CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery (bsc#1276128).

Changes for trivy:

• Update to version 0.74.0:

• release: v0.74.0 [main] (#11037)
• chore(deps): update golang.org/x modules (#11094)
• chore(deps): bump the docker group with 2 updates (#11090)
• docs: update release branch ruleset instructions (#11093)
• chore(deps): bump the common group across 1 directory with 7 updates (#11086)
• fix(misconf): unmark cty values outside the evaluation context (#11078)
• chore(deps): bump the aws group across 1 directory with 6 updates (#11053)
• fix(misconf): parse Azure flexible server parameters under their own names (#11072)
• chore(deps): bump the docker group with 2 updates (#11054)
• feat: add RapidFort curated image scanner (#10452)
• feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948)
• refactor(misconf): remove unused Azure expression-related code (#10637)
• fix(server): preserve check aliases and query in uploaded blobs (#11080)
• fix(java): read artifact properties only from the MANIFEST.MF main section (#11066)
• fix(terraform): support OpenTofu language block (#10923)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063)
• ci: trigger Auto Ready for Review after Test docs (#11045)
• docs: remove trivy-checks from AWS ECR locations (#11044)
• refactor(ubuntu): move EOL version resolution out of loop (#11047)
• fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050)
• chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042)
• chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038)
• fix(terraform): avoid panic when for_each local has unknown object values (#11019)
• chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028)
• ci(spdx): migrate to Slack notifications (#11032)
• ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034)

• Update to version 0.73.0:

• release: v0.73.0 [main] (#11012)
• docs: clarify debug logs when version check or telemetry is disabled (#10984)
• feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)
• chore(deps): bump the common group across 1 directory with 17 updates (#11025)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10991)
• chore(deps): bump the aws group across 1 directory with 6 updates (#10947)
• refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)
• feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)
• refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)
• chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)
• fix(vex): reject non-local VEX repository names (#10987)
• fix(vex): handle 304 status code (#10307)
• fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980)
• fix(conda): avoid panic on an all-operator dependency line (#10955)
• chore: add schema id (#10969)
• feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)
• feat: add bounded read helpers (#10974)
• fix(dotnet): identify deps.json root project from dependency graph (#10954)
• feat(java): read Jenkins plugin manifest licenses (#10939)
• docs: ask contributors to coordinate before starting on an issue (#10940)
• fix(nodejs): support pnpm workspaces with overlapping packages (#10894)
• ci: create release branch with the App token to bypass the merge queue rule (#10931)
• chore(deps): bump the common group across 1 directory with 15 updates (#10892)
• feat(seal): detect no-prefix packages by version suffix (#10911)
• chore(deps): bump the testcontainers group with 2 updates…

This update for v2ray-core fixes the following issues:

Changes in v2ray-core:

• Update version to 5.53.0

  • Add X-Forwarded-For support to gRPC transport
  • Add Stream based Packet Addr for UDP Connections
  • rrpit: compact session, async send, session recovery
  • Add socks5ify engineering command
  • Fix bugs
  • Update modules (boo#1276119 and CVE-2026-72817, CVE-2026-72815, CVE-2026-72816)

• Update version to 5.51.2

  • Wireguard Add TCP Listener support for wireguard outbound
  • Stun Nat Type Testing
  • Better server failure detection and PreserveSourceIPPortWhenDestNATMapping detection
  • Improve API instance support
  • feat: grpc: allow configurable keepalive and initial windows size
  • Add RRPIT - Rapid Reliable Packet Interactive Transport
  • Add WebRTC Tunnel Support in V2Ray(unreleased)
  • also parse X-Forwarded-For in httpupgrade
  • gdocsviewer: Add Google Docs Viewer based transport
  • gdocsviewer: Refine poll logic and allow custom headers to reduce rate limiting
  • gdocsviewer: allow adding headers in public config
  • Fix bugs (boo#1258546 and CVE-2026-27017)

• update golang.org/x/net to 0.55.0 to fix boo#1266787 and CVE-2026-39821

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.8.2
  • Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)
  • Add OpenRC support
  • Migrate config renovate.json
  • Fix bugs

This update for hauler fixes the following issues:

Changes in hauler:

• update to 2.1.0 (bsc#1265425, CVE-2026-41888):

  • v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling.
  • Notable dependency bumps: Go → 1.26.6; containerd/v2 → 2.3.4; sigstore/cosign/v3 → 3.1.3; sigstore/sigstore → 1.10.9; go-containerregistry → 0.22.0; helm/v4 → 4.2.4; k8s.io libs (apimachinery, api, client-go) → 0.37.0; logrus → 1.10.2; docker/go-metrics → 0.1.0; sigstore/rekor → 1.5.4 (CVE resolution); plus x/mod and go-isatty.

• update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):

  • Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688)
  • Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691)
  • fix for homebrew macOS binary quarantine (backport #690)
  • fix: process Helm deps before --add-images discovery (backport #703)
  • update hauler store remove to handle registry reference as part of string (backport #705)
  • fixed vuln for golang grpc

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

• updating to v4.7.1 with the following changes
  • wwctl power no longer falls back to the local BMC for nodes with no ipmi: ipaddr:, which could power off the Warewulf server itself
  • wwclient is built with GOAMD64=v1 and no longer fails with an illegal instruction on older nodes
  • prevent image and overlay corruption from 64-bit inode numbers truncating in cpio
  • fix kernel version detection for releases with a version-like suffix after the dist tag
  • several fixes for IPv6-only servers and nodes: dracut boot, wwctl node status, dnsmasq, NetworkManager
  • remove dsa from the default ssh: key types, which could leave nodes with no usable host keys on EL9
  • mount non-root filesystems before image extraction during provision-to-disk
  • overlay template fixes for parent directories and symbolic links
• dependency updates, including go-jose 4.1.4 for CVE-2026-34986 (bsc#1262805)
• updated go-chi to v5.3.2 to fix CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing: authentication bypass, authorization override, and log forgery) (bsc#1276100)