Skip to main content

go-chi chi CVE-2026-72817

| EUVDEUVD-2026-58632 MEDIUM
Insufficient Verification of Data Authenticity (CWE-345)
2026-08-14 VulnCheck GHSA-9f4g-6whf-f3pv
Authentication Bypass Chi Red Hat Suse
6.9
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.5 MEDIUM

Network-exploitable with no authentication as any HTTP client can forge XFF headers; limited C and I impact bounded by what the application does with the spoofed IP.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 14, 2026 - 13:01 EUVD
Source Code Evidence Fetched
Aug 14, 2026 - 12:39 vuln.today
Analysis Generated
Aug 14, 2026 - 12:39 vuln.today

DescriptionCVE.org

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

AnalysisAI

IP spoofing in go-chi's RealIP middleware allows unauthenticated network attackers to forge the apparent client source IP by prepending an arbitrary value to the X-Forwarded-For header, because the middleware blindly trusts the leftmost entry rather than walking the header right-to-left past trusted proxies. Applications that use middleware.RealIP() for IP-based access control or audit logging are directly exposed across all major version branches (v1 through v5 before 5.3.0). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify chi application with RealIP middleware enabled
Delivery
Craft request with forged IP prepended to X-Forwarded-For
Exploit
Route request through any upstream proxy or load balancer
Execution
Middleware reads leftmost forged IP as client source
Persist
Request.RemoteAddr set to attacker-controlled value
Impact
Bypass IP-based access control and access restricted resource
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three specific conditions to be present simultaneously. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L) correctly reflects unauthenticated, low-complexity network exploitation with limited but real integrity and confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targets a Go microservice using chi's RealIP middleware to enforce an IP allowlist on an administrative API endpoint. The attacker sends an HTTP request with the header 'X-Forwarded-For: 10.10.1.5, <attacker-ip>', where 10.10.1.5 is a known permitted internal address. …
Remediation For v5 users, upgrade github.com/go-chi/chi/v5 to version 5.3.0 or later per the CVE description; verify the release tag against the chi changelog at https://github.com/go-chi/chi/security/advisories/GHSA-9g5q-2w5x-hmxf before deploying, as the GHSA source data lists 'fixed in: None' for all packages - this discrepancy should be confirmed independently. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chi

View all
CVE-2026-72815 MEDIUM
6.9 Aug 14

IP spoofing via the RealIP middleware in go-chi/chi (versions 5.2.1 through 5.2.x) allows unauthenticated remote attacke
CVE-2026-72816 MEDIUM
6.9 Aug 14

IP spoofing in go-chi/chi's RealIP middleware through version 5.2.1 enables unauthenticated remote attackers to inject a
CVE-2025-71405 MEDIUM
5.1 Aug 14

Open redirect in chi (go-chi/chi) versions before 5.2.2 allows Host header injection via the RedirectSlashes middleware,

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all
CVE-2023-38831 HIGH POC
7.8
CVE-2016-4553 HIGH
8.6
CVE-2016-4554 HIGH
8.6
CVE-2014-4936 CRITICAL POC
9.3
CVE-2025-66255 CRITICAL POC
9.9
CVE-2025-1945 CRITICAL POC
9.8
CVE-2024-11666 CRITICAL POC
9.8
CVE-2024-1554 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

CVE-2026-72817 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy