CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

Summary

The vulnerability allows the Request.RemoteAddr to be spoofed when determining the request source IP via the X-Forwarded-For header. This could result in misidentification of the request source and potentially compromise access control and logging integrity.

Details

Currently, the RealIP() implementation splits the X-Forwarded-For header by , and uses the first IP. https://github.com/go-chi/chi/blob/v5.1.0/middleware/realip.go#L50-L54

However, relying on the first IP in the X-Forwarded-For header is insecure because it can be manipulated by attackers to falsify the source IP.

Malicious Case:

1. A malicious client sends a request with a forged IP in the X-Forwarded-For header: X-Forwarded-For: <forged-ip>
2. The proxy appends the actual client’s IP and forwards the request: X-Forwarded-For: <forged-ip>,<client-ip>
3. If the server always uses the first IP, it becomes vulnerable to IP spoofing.

Ideally, the implementation should verify IPs starting from the end of the X-Forwarded-For header value, skipping trusted IPs within the system, and using the first untrusted IP as the actual client IP.

For example, the labstack/echo web framework processes the X-Forwarded-For header by checking IPs from the end, skipping trusted IPs, and using the first untrusted IP as the client's ip. https://github.com/labstack/echo/blob/v4.13.2/ip.go#L261-L273

PoC

1. Run the Go application with the following code:

package main

import (
    "fmt"
    "log"
    "net/http"

    "github.com/go-chi/chi/v5/middleware"
)

func main() {
    // Set handler to print the remote address
    handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        fmt.Fprintln(
            w,
            fmt.Sprintf("remote addr: %s (want 192.0.2.1)", r.RemoteAddr),
        )
    })
    // Use RealIP middleware
    log.Fatal(http.ListenAndServe(":8080", middleware.RealIP(handler)))
}

2. Send a request to the server using curl with a manipulated X-Forwarded-For header:

$ curl localhost:8080 -H 'X-Forwarded-For: 192.0.2.2, 192.0.2.1'
remote addr: 192.0.2.2 (want 192.0.2.1)

Impact

This vulnerability can lead to a request source IP spoofing issue, which may allow attackers to bypass access controls or falsify request logs. It primarily affects systems that rely on X-Forwarded-For to determine the actual client IP, particularly in scenarios where intermediary proxies or load balancers are involved.

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi

These are all security issues fixed in the hauler-2.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the trivy-0.74.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the golang-github-v2fly-v2ray-core-5.53.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the warewulf4-4.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for trivy fixes the following issue:

• CVE-2026-72815,CVE-2026-72816,CVE-2026-72817: github.com/go-chi/chi/v5: multiple IP spoofing vulnerabilities allow authentication bypass, authorization override, and log forgery (bsc#1276128).

Changes for trivy:

• Update to version 0.74.0:

• release: v0.74.0 [main] (#11037)
• chore(deps): update golang.org/x modules (#11094)
• chore(deps): bump the docker group with 2 updates (#11090)
• docs: update release branch ruleset instructions (#11093)
• chore(deps): bump the common group across 1 directory with 7 updates (#11086)
• fix(misconf): unmark cty values outside the evaluation context (#11078)
• chore(deps): bump the aws group across 1 directory with 6 updates (#11053)
• fix(misconf): parse Azure flexible server parameters under their own names (#11072)
• chore(deps): bump the docker group with 2 updates (#11054)
• feat: add RapidFort curated image scanner (#10452)
• feat(java): resolve JAR license URLs to SPDX IDs (Bundle-License, pom <url>) (#10948)
• refactor(misconf): remove unused Azure expression-related code (#10637)
• fix(server): preserve check aliases and query in uploaded blobs (#11080)
• fix(java): read artifact properties only from the MANIFEST.MF main section (#11066)
• fix(terraform): support OpenTofu language block (#10923)
• chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#11063)
• ci: trigger Auto Ready for Review after Test docs (#11045)
• docs: remove trivy-checks from AWS ECR locations (#11044)
• refactor(ubuntu): move EOL version resolution out of loop (#11047)
• fix(python): normalize dependency names in PEP 621 pyproject.toml (#11050)
• chore(deps): bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 (#11042)
• chore(deps): bump github.com/nikolalohinski/gonja/v2 to v2.9.0 (#11038)
• fix(terraform): avoid panic when for_each local has unknown object values (#11019)
• chore(deps): bump the github-actions group across 2 directories with 15 updates (#11028)
• ci(spdx): migrate to Slack notifications (#11032)
• ci(helm): bump Trivy version to 0.73.0 for Trivy Helm Chart 0.25.0 (#11034)

• Update to version 0.73.0:

• release: v0.73.0 [main] (#11012)
• docs: clarify debug logs when version check or telemetry is disabled (#10984)
• feat(java): support user-defined Maven mirrors in trivy.yaml (#11006)
• chore(deps): bump the common group across 1 directory with 17 updates (#11025)
• chore(deps): bump the docker group across 1 directory with 2 updates (#10991)
• chore(deps): bump the aws group across 1 directory with 6 updates (#10947)
• refactor(alpine): remove type assertion when reading the APKINDEX archive (#11013)
• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#10995)
• feat(vex): discover OpenVEX in generic in-toto OCI referrers (#10986)
• refactor(vuln): add OS.Supplier field and unify supplier terminology (#11007)
• chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.30.0 (#11009)
• fix(vex): reject non-local VEX repository names (#10987)
• fix(vex): handle 304 status code (#10307)
• fix(vuln): don't skip packages covered by a driver's own advisory feed (#10980)
• fix(conda): avoid panic on an all-operator dependency line (#10955)
• chore: add schema id (#10969)
• feat(vex): native discovery of VEX documents stored as OCI artifacts (#10932)
• feat: add bounded read helpers (#10974)
• fix(dotnet): identify deps.json root project from dependency graph (#10954)
• feat(java): read Jenkins plugin manifest licenses (#10939)
• docs: ask contributors to coordinate before starting on an issue (#10940)
• fix(nodejs): support pnpm workspaces with overlapping packages (#10894)
• ci: create release branch with the App token to bypass the merge queue rule (#10931)
• chore(deps): bump the common group across 1 directory with 15 updates (#10892)
• feat(seal): detect no-prefix packages by version suffix (#10911)
• chore(deps): bump the testcontainers group with 2 updates…

This update for v2ray-core fixes the following issues:

Changes in v2ray-core:

• Update version to 5.53.0

  • Add X-Forwarded-For support to gRPC transport
  • Add Stream based Packet Addr for UDP Connections
  • rrpit: compact session, async send, session recovery
  • Add socks5ify engineering command
  • Fix bugs
  • Update modules (boo#1276119 and CVE-2026-72817, CVE-2026-72815, CVE-2026-72816)

• Update version to 5.51.2

  • Wireguard Add TCP Listener support for wireguard outbound
  • Stun Nat Type Testing
  • Better server failure detection and PreserveSourceIPPortWhenDestNATMapping detection
  • Improve API instance support
  • feat: grpc: allow configurable keepalive and initial windows size
  • Add RRPIT - Rapid Reliable Packet Interactive Transport
  • Add WebRTC Tunnel Support in V2Ray(unreleased)
  • also parse X-Forwarded-For in httpupgrade
  • gdocsviewer: Add Google Docs Viewer based transport
  • gdocsviewer: Refine poll logic and allow custom headers to reduce rate limiting
  • gdocsviewer: allow adding headers in public config
  • Fix bugs (boo#1258546 and CVE-2026-27017)

• update golang.org/x/net to 0.55.0 to fix boo#1266787 and CVE-2026-39821

This update for cloudflared fixes the following issues:

Changes in cloudflared:

• Update version to 2026.8.2
  • Update vendor archive to fix github.com/go-chi/chi/v5 (boo#1276196, CVE-2026-72815, CVE-2026-72816, CVE-2026-72817)
  • Add OpenRC support
  • Migrate config renovate.json
  • Fix bugs

This update for hauler fixes the following issues:

Changes in hauler:

• update to 2.1.0 (bsc#1265425, CVE-2026-41888):

  • v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling.
  • Notable dependency bumps: Go → 1.26.6; containerd/v2 → 2.3.4; sigstore/cosign/v3 → 3.1.3; sigstore/sigstore → 1.10.9; go-containerregistry → 0.22.0; helm/v4 → 4.2.4; k8s.io libs (apimachinery, api, client-go) → 0.37.0; logrus → 1.10.2; docker/go-metrics → 0.1.0; sigstore/rekor → 1.5.4 (CVE resolution); plus x/mod and go-isatty.

• update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):

  • Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688)
  • Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691)
  • fix for homebrew macOS binary quarantine (backport #690)
  • fix: process Helm deps before --add-images discovery (backport #703)
  • update hauler store remove to handle registry reference as part of string (backport #705)
  • fixed vuln for golang grpc

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

• updating to v4.7.1 with the following changes
  • wwctl power no longer falls back to the local BMC for nodes with no ipmi: ipaddr:, which could power off the Warewulf server itself
  • wwclient is built with GOAMD64=v1 and no longer fails with an illegal instruction on older nodes
  • prevent image and overlay corruption from 64-bit inode numbers truncating in cpio
  • fix kernel version detection for releases with a version-like suffix after the dist tag
  • several fixes for IPv6-only servers and nodes: dracut boot, wwctl node status, dnsmasq, NetworkManager
  • remove dsa from the default ssh: key types, which could leave nodes with no usable host keys on EL9
  • mount non-root filesystems before image extraction during provision-to-disk
  • overlay template fixes for parent directories and symbolic links
• dependency updates, including go-jose 4.1.4 for CVE-2026-34986 (bsc#1262805)
• updated go-chi to v5.3.2 to fix CVE-2026-72815, CVE-2026-72816 and CVE-2026-72817 (IP spoofing: authentication bypass, authorization override, and log forgery) (bsc#1276100)