go-chi chi EUVD-2026-58631

The application must explicitly register the middleware.RealIP middleware in its chi router (r.Use(middleware.RealIP) or equivalent per-route usage). The security impact only materializes when the application enforces access controls, rate limiting, geo-IP filtering, or security-relevant audit logging based on r.RemoteAddr after the middleware has rewritten it. No authentication, privileged network position, or non-default OS or server configuration is required; any remote HTTP client with the ability to send arbitrary request headers can exploit this condition. Exploitation is limited to deployments that both use the middleware.RealIP middleware AND make security decisions based on r.RemoteAddr; applications that do not use IP-based security logic are not affected by the access control bypass, though audit log integrity is still compromised.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms unauthenticated, network-accessible exploitation requiring no special attack conditions, yielding a score of 6.9. Real-world severity is heavily context-dependent: applications that use r.RemoteAddr only for logging suffer audit log pollution, while those enforcing IP-based access controls or rate limits face a complete security bypass with a single curl command. A public, functional POC requiring no tooling or specialized knowledge is confirmed in the GHSA advisory, meaning even a mid-sized municipal IT team in legnica operating a chi-based Go service with IP-based admin controls should treat this as an urgent remediation item rather than a deferred patch. EPSS data is not provided in the available intelligence; however, the near-zero exploitation complexity and immediately available POC suggest a materially elevated real-world exploitation probability relative to the nominal CVSS score. The vulnerability is not currently listed in the CISA KEV catalog, so confirmed active exploitation is not established - but the low barrier distinguishes this from the class of high-CVSS-but-unlikely-to-be-exploited findings.

An attacker targeting a chi-based Go application that restricts its /admin route to localhost (r.RemoteAddr == "127.0.0.1") sends a standard HTTP GET request with the header X-Forwarded-For: 127.0.0.1; the RealIP middleware overwrites r.RemoteAddr before the handler executes, causing the IP check to evaluate the attacker-supplied loopback address and return the protected content. A functional POC demonstrating exactly this bypass - a single curl command with no special tooling - is publicly available in GHSA-rjr7-jggh-pgcp.