CVE-2026-72816: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-72816 is an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go) of the go-chi/chi Go HTTP router framework. The flaw affects all versions through 5.2.1 and was disclosed on August 14, 2026, with a fix released in version 5.3.0. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium), assigned by VulnCheck (GitHub Advisory, VulnCheck Advisory).

The root cause is classified as CWE-290 (Authentication Bypass by Spoofing) and CWE-348 (Use of Less Trusted Source). The vulnerable realIP() function in middleware/realip.go unconditionally reads the True-Client-IP, X-Real-IP, and X-Forwarded-For HTTP headers supplied by the client and overwrites r.RemoteAddr without validating that the request originated from a trusted proxy CIDR. Because these headers are fully client-controlled, any unauthenticated network attacker can inject an arbitrary IP address with a single HTTP request — no special privileges or user interaction required. A proof-of-concept demonstrating the bypass via curl -H "X-Forwarded-For: 127.0.0.1" is included in the GitHub security advisory (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to bypass IP-based access controls (e.g., reaching admin-only endpoints restricted to localhost or internal ranges), evade rate limiting by rotating spoofed source IPs, circumvent geo-IP restrictions, and inject false source IP addresses into audit logs — undermining forensic integrity. Confidentiality and integrity are partially impacted; availability is not directly affected. The scope of impact depends on how heavily the application relies on r.RemoteAddr for security decisions (GitHub Advisory, VulnCheck Advisory).

CISA's SSVC assessment classifies this vulnerability as having a PoC available and being automatable, indicating low exploitation complexity (NVD). The GitHub security advisory includes a working PoC demonstrating the bypass with a single curl command. No evidence of active in-the-wild exploitation or threat actor attribution has been reported at this time. The EPSS score is approximately 0.219% (13th percentile), suggesting a currently low but non-negligible probability of exploitation in the near term (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a web application built with go-chi/chi version ≤ 5.2.1 that uses the middleware.RealIP middleware and enforces IP-based access controls (e.g., admin panels restricted to internal IPs).
2. Craft spoofed request: Prepare an HTTP request with a forged IP address in one of the trusted headers. The middleware checks headers in priority order: True-Client-IP first, then X-Real-IP, then X-Forwarded-For.
3. Send the request: Issue the request directly to the target server, injecting the desired spoofed IP:

   curl -H "X-Forwarded-For: 127.0.0.1" http://target.example.com/admin

   or using True-Client-IP for higher priority:

   curl -H "True-Client-IP: 10.0.0.1" http://target.example.com/restricted

4. Bypass access control: The middleware overwrites r.RemoteAddr with the attacker-supplied IP. Any downstream handler checking r.RemoteAddr for IP-based authorization will see the spoofed address and grant access.
5. Evade rate limiting / logging: Rotate spoofed IPs across requests to bypass per-IP rate limits, or inject a consistent fake IP to pollute audit logs and obscure the attacker's true origin (GitHub Advisory).

• Network: HTTP requests to sensitive or admin endpoints originating from unexpected external IPs that contain X-Forwarded-For, X-Real-IP, or True-Client-IP headers not set by a known reverse proxy; rapid requests from many different spoofed source IPs suggesting rate-limit evasion.
• Logs: Application access logs showing r.RemoteAddr values of internal/loopback addresses (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x) for requests arriving directly from the internet without passing through a legitimate proxy; discrepancies between TCP-layer source IPs and logged RemoteAddr values.
• Application Behavior: Successful access to IP-restricted endpoints (e.g., admin routes) from clients that should not have network-level access; rate limiting controls appearing ineffective with high request volumes from varied apparent source IPs (GitHub Advisory).

Upgrade go-chi/chi to version 5.3.0 or later, which addresses the vulnerability by validating that forwarded IP headers are only trusted when the request originates from a configured trusted proxy CIDR (GitHub Advisory, VulnCheck Advisory). If immediate patching is not feasible, consider disabling the middleware.RealIP middleware entirely if IP-based access controls are security-critical, or implement a custom middleware that validates the request source against a trusted proxy allowlist before honoring forwarded headers. Additionally, enforce IP-based access controls at the network/infrastructure layer (e.g., firewall rules, reverse proxy ACLs) rather than relying solely on application-layer header inspection.

The vulnerability was reported by researcher rezmoss and published via GitHub's security advisory system on May 22, 2026 (GHSA-rjr7-jggh-pgcp), with the CVE formally assigned and published on August 14, 2026 (GitHub Advisory). VulnCheck acted as the CVE Numbering Authority (CNA) and published a corresponding advisory. CISA-ADP added the reference to the NVD record and assessed the vulnerability as automatable with a PoC available. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified at this time.