Skip to main content

go-chi chi CVE-2026-72816

| EUVDEUVD-2026-58631 MEDIUM
Authentication Bypass by Spoofing (CWE-290)
2026-08-14 VulnCheck GHSA-xg24-pmhh-m4m9
Authentication Bypass Chi Red Hat Suse
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-accessible, no privileges or interaction required; limited confidentiality and integrity impact from access control bypass and log corruption; no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 14, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 14, 2026 - 12:39 vuln.today
Analysis Generated
Aug 14, 2026 - 12:39 vuln.today

DescriptionCVE.org

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

AnalysisAI

IP spoofing in go-chi/chi's RealIP middleware through version 5.2.1 enables unauthenticated remote attackers to inject arbitrary values into the True-Client-IP, X-Real-IP, or X-Forwarded-For headers, which the middleware blindly accepts and uses to overwrite r.RemoteAddr without any trusted-proxy verification. Applications that rely on r.RemoteAddr for IP-based access controls, rate limiting, or geo-IP restrictions are directly bypassed, and audit logs are silently corrupted with attacker-chosen addresses. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send HTTP request with spoofed X-Forwarded-For header
Delivery
RealIP middleware overwrites r.RemoteAddr unconditionally
Exploit
Application evaluates spoofed IP for access control
Execution
IP-based restriction bypassed entirely
Impact
Attacker reaches restricted endpoint or evades rate limit
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The application must explicitly register the middleware.RealIP middleware in its chi router (r.Use(middleware.RealIP) or equivalent per-route usage). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, network-accessible exploitation requiring no special attack conditions, yielding a score of 6.9. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting a chi-based Go application that restricts its /admin route to localhost (r.RemoteAddr == "127.0.0.1") sends a standard HTTP GET request with the header X-Forwarded-For: 127.0.0.1; the RealIP middleware overwrites r.RemoteAddr before the handler executes, causing the IP check to evaluate the attacker-supplied loopback address and return the protected content. A functional POC demonstrating exactly this bypass - a single curl command with no special tooling - is publicly available in GHSA-rjr7-jggh-pgcp.
Remediation Upgrade go-chi/chi v5 to version 5.3.0 or later, which is the only confirmed fix; this release introduces trusted-proxy CIDR validation before the middleware accepts any forwarded IP header. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chi

View all
CVE-2026-72815 MEDIUM
6.9 Aug 14

IP spoofing via the RealIP middleware in go-chi/chi (versions 5.2.1 through 5.2.x) allows unauthenticated remote attacke
CVE-2026-72817 MEDIUM
6.9 Aug 14

IP spoofing in go-chi's RealIP middleware allows unauthenticated network attackers to forge the apparent client source I
CVE-2025-71405 MEDIUM
5.1 Aug 14

Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware,

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all
CVE-2024-54085 CRITICAL
9.8
CVE-2023-50224 MEDIUM
6.5
CVE-2024-4358 CRITICAL POC
9.8
CVE-2018-5353 CRITICAL POC
9.8
CVE-2023-51350 CRITICAL POC
9.8
CVE-2022-3180 CRITICAL
9.8
CVE-2025-66570 CRITICAL POC
10.0
CVE-2025-49002 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-72816 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy