Speedtest Tracker CVE-2026-108736

Exploitation requires that the instance actually uses IP-based access control - i.e., ALLOWED_IPS is set and/or the Prometheus endpoint allowlist is enabled - because the attack bypasses those allowlists; an instance with no allowlist configured has nothing to bypass. The enabling defect is that bootstrap/app.php trusts all peers as proxies, so any user-supplied X-Forwarded-For value is accepted as the client IP. Limiting factors: the target must be network-reachable by the attacker; the confirmed impact is limited to information disclosure of /prometheus metrics and reaching allowlist-gated endpoints (endpoints that additionally enforce application login are not necessarily compromised); affected versions are 1.15.0 and earlier.

This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) confirms unauthenticated, low-complexity remote exploitation, but the impact is narrow: only confidentiality is affected and only at Low (VC:L, with VI:N/VA:N), consistent with the described capability of reading /prometheus metrics and reaching allowlist-protected endpoints rather than achieving code execution or data modification. The AT:P (attack requirements present) metric is the key limiter - exploitation only matters where an IP allowlist (ALLOWED_IPS or the Prometheus allowlist) is actually configured and the instance is reachable, since there is nothing to bypass otherwise. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no exploit code is confirmed published (the referenced HackMD page is a technical write-up, not a verified weaponized POC), so there is no evidence of active exploitation. The signals are internally consistent: a low-complexity unauthenticated flaw with limited (information-disclosure) impact against a niche self-hosted product - real and worth patching, but not a widespread-exploitation threat.

An attacker who can reach an internet-exposed Speedtest Tracker instance that relies on ALLOWED_IPS or Prometheus IP allowlisting sends an HTTP request containing a forged X-Forwarded-For header set to an allowlisted address. Because bootstrap/app.php trusts every peer as a proxy, the application honors the spoofed client IP and grants access, letting the unauthenticated attacker read /prometheus metrics and reach otherwise allowlist-protected web and API endpoints. A detailed technical write-up exists but no confirmed exploit tool was identified.