Skip to main content

go-chi chi CVE-2026-72815

| EUVDEUVD-2026-58630 MEDIUM
Authentication Bypass by Spoofing (CWE-290)
2026-08-14 VulnCheck GHSA-qgxv-hqxp-4rcx
Authentication Bypass Chi Red Hat Suse
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible, no complexity or privilege needed; impacts are limited to ACL bypass and log forgery with no availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 14, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 14, 2026 - 12:39 vuln.today
Analysis Generated
Aug 14, 2026 - 12:39 vuln.today

DescriptionCVE.org

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

AnalysisAI

IP spoofing via the RealIP middleware in go-chi/chi (versions 5.2.1 through 5.2.x) allows unauthenticated remote attackers to bypass IP-based access control lists, circumvent rate-limiting mechanisms, and forge log entries by prepending a fabricated address to the X-Forwarded-For HTTP header. A proof-of-concept is included in the GitHub security advisory (GHSA-3fxj-6jh8-hvhx), confirming exploitability against any chi application that enables the RealIP middleware and enforces controls based on the overwritten r.RemoteAddr. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send HTTP request with spoofed X-Forwarded-For header
Delivery
RealIP middleware extracts leftmost (attacker-controlled) value
Exploit
r.RemoteAddr overwritten with spoofed IP
Execution
Application IP-ACL evaluates forged address
Persist
ACL or rate-limit bypass achieved
Impact
Access restricted resource or evade throttling
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires two simultaneous conditions: first, the application must explicitly register middleware.RealIP in its chi router chain (r.Use(middleware.RealIP)); second, the application must implement access controls - IP-based ACLs, rate limiting, or audit logging - that rely on r.RemoteAddr or r.Request.RemoteAddr as overwritten by the middleware. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) reflects a straightforward, unauthenticated, low-complexity network attack with no prerequisites beyond sending an HTTP request - the lowest possible exploitation barrier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting an IP-restricted chi endpoint sends a GET /admin/secret HTTP request with the header 'X-Forwarded-For: 1.2.3.4' (an allowlisted administrator IP) from their own arbitrary IP. The RealIP middleware overwrites r.RemoteAddr with '1.2.3.4', causing the application's IP-ACL check to succeed and granting access to the restricted resource. …
Remediation Upgrade go-chi/chi to version 5.3.0, which fixes the vulnerability by no longer blindly trusting the leftmost X-Forwarded-For value. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chi

View all
CVE-2026-72816 MEDIUM
6.9 Aug 14

IP spoofing in go-chi/chi's RealIP middleware through version 5.2.1 enables unauthenticated remote attackers to inject a
CVE-2026-72817 MEDIUM
6.9 Aug 14

IP spoofing in go-chi's RealIP middleware allows unauthenticated network attackers to forge the apparent client source I
CVE-2025-71405 MEDIUM
5.1 Aug 14

Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware,

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-72815 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy