CVE-2026-114437: 
Datadog Agent vulnerability analysis and mitigation

CVE-2026-114437 is a client IP spoofing vulnerability in the Golang Chi web framework's ClientIPFromXFF middleware that allows unauthenticated remote attackers to forge their apparent client IP address by manipulating the X-Forwarded-For header. It affects github.com/go-chi/chi/v5 versions prior to 5.4.0 (≤ 5.3.2). The vulnerability was reported to the Chi project on October 6, 2026, patched in version 5.4.0 on October 12, 2026, and publicly disclosed on October 21, 2026. It carries a CVSS v3.1 base score of 4.8 (Medium) and a CVSS v4.0 base score of 6.3 (Medium) (Tenable Advisory, GitHub Advisory).

The root cause is an origin validation error (CWE-346 / CWE-348) in the ClientIPFromXFF function located in middleware/client_ip.go. The walkXFF function iterates over attacker-controlled X-Forwarded-For header values, skipping entries that match a configured trusted CIDR — but it never validates that the actual TCP peer (http.Request.RemoteAddr) is itself within that trusted CIDR. As a result, any client with direct TCP access to the Go server can append a trusted-looking proxy IP to the X-Forwarded-For header (e.g., X-Forwarded-For: <desired-ip>, <trusted-proxy-cidr-ip>), causing middleware.GetClientIP to return the attacker-chosen IP. The precondition is that the application uses ClientIPFromXFF with a configured trusted CIDR and that the origin server is reachable by clients outside that CIDR (GitHub Advisory, Tenable Advisory).

Successful exploitation allows an unauthenticated attacker to bypass IP-based access controls by impersonating any allowlisted client IP address, potentially gaining unauthorized access to protected application endpoints (e.g., administrative handlers). The integrity impact includes unauthorized authorization decisions (e.g., HTTP 403 → 200 OK), and the confidentiality impact includes exposure of data or functionality restricted to trusted IP ranges. Availability is not affected, and the scope is limited to the vulnerable application itself (GitHub Advisory, Feedly).

A proof-of-concept (PoC) is included in the GitHub security advisory and was confirmed by Tenable during coordinated disclosure; the NVD SSVC assessment also classifies exploitation status as "poc." No evidence of in-the-wild exploitation has been observed, and the EPSS score is 0.0. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only a single unauthenticated HTTP request with a crafted X-Forwarded-For header, but the attacker must have direct TCP access to the Go server (bypassing any upstream proxy), which raises the attack complexity (Tenable Advisory, GitHub Advisory).

1. Reconnaissance: Identify a Go application using the Chi framework (v5.3.2 or earlier) with ClientIPFromXFF middleware and IP-based access controls. Determine the trusted proxy CIDR configured in the middleware (e.g., 198.51.100.0/24) and the allowlisted client IP (e.g., 10.0.0.7).
2. Verify direct access: Confirm that the target Go server is reachable directly (not exclusively through a trusted reverse proxy) by sending a baseline request: curl -i http://<target>/admin. Expect a 403 Forbidden response with an empty client-ip.
3. Craft the forged header: Construct an X-Forwarded-For header with the desired spoofed client IP followed by an IP within the trusted proxy CIDR: X-Forwarded-For: <allowlisted-ip>, <trusted-proxy-cidr-ip> (e.g., X-Forwarded-For: 10.0.0.7, 198.51.100.42).
4. Send the exploit request: Issue the HTTP request with the forged header directly to the origin server: curl -i -H 'X-Forwarded-For: 10.0.0.7, 198.51.100.42' http://<target>/admin.
5. Achieve access: The middleware skips the trusted-CIDR entry (198.51.100.42) and returns 10.0.0.7 as the client IP, causing the application to grant access and return 200 OK (GitHub Advisory).

• Network: HTTP requests to sensitive or admin endpoints (e.g., /admin) arriving directly at the origin server (not via a legitimate reverse proxy) with X-Forwarded-For headers containing multiple IP addresses, where the last entry falls within a configured trusted proxy CIDR.
• Logs: Application access logs showing requests with X-Forwarded-For values that include both an internal/allowlisted IP and a trusted-proxy-range IP, originating from an unexpected external RemoteAddr; successful 200 OK responses to protected endpoints from direct connections that should have been rejected.
• Behavioral: Unexpected authorization grants (e.g., access to admin functionality) from IP addresses not belonging to the configured trusted proxy infrastructure, particularly when the TCP peer address does not match the trusted CIDR (GitHub Advisory, Tenable Advisory).

Upgrade github.com/go-chi/chi/v5 to version 5.4.0 or later, which validates that the direct TCP peer (http.Request.RemoteAddr) belongs to the configured trusted CIDR before trusting X-Forwarded-For entries. As a network-level workaround, implement network segmentation to ensure the Go origin server is only reachable from legitimate proxy servers within the trusted CIDR, preventing untrusted clients from making direct TCP connections. Applications that do not use ClientIPFromXFF or do not rely on IP-based access controls are not affected (Tenable Advisory, GitHub Advisory).

The vulnerability was discovered and reported by Joshua Martinelle of Tenable through coordinated disclosure with the Chi maintainers, who acknowledged the issue and released a fix (PR #1214) within six days of the initial report. The Chi security advisory was published by maintainer VojtechVitek on October 12, 2026, and Red Hat opened a tracking bug (Bugzilla #2558305) with 59 CC'd users, indicating broad interest across Red Hat product teams. No significant broader media coverage or notable social media commentary has been identified beyond standard vulnerability database aggregation (Tenable Advisory, Red Hat Bugzilla).