CVE-2026-72817: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-72817 is an IP spoofing vulnerability in the RealIP middleware of the go-chi/chi Go web framework. The flaw allows unauthenticated remote attackers to forge the apparent source IP address of HTTP requests by manipulating the X-Forwarded-For header. Affected versions span from 0.9.0 up to (but not including) 5.3.0 of github.com/go-chi/chi/middleware. The vulnerability was published on August 14, 2026, with a patch available in version 5.3.0. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium), assigned by VulnCheck (GitHub Advisory, Github Advisory DB).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). The vulnerable RealIP() middleware implementation splits the X-Forwarded-For header by comma and unconditionally uses the first IP value as the resolved client IP (Request.RemoteAddr), without validating whether the preceding entries originate from trusted proxies (GitHub Advisory). Because HTTP clients can freely set arbitrary X-Forwarded-For values, an attacker simply prepends a forged IP (e.g., X-Forwarded-For: <forged-ip>, <real-ip>) before the request reaches the server; the proxy appends the real client IP at the end, but the middleware reads only the first entry. The correct approach — as implemented by frameworks such as labstack/echo — is to traverse the header from right to left, skipping known trusted proxy IPs, and treating the first untrusted IP as the actual client address (GitHub Advisory). A public proof-of-concept demonstrating the issue is included in the official security advisory.

Successful exploitation allows an attacker to make server-side logic believe requests originate from an arbitrary IP address of the attacker's choosing. This can lead to bypass of IP-based access controls (e.g., admin panels, rate limiters, or allowlists restricted to specific IP ranges) and falsification of request logs, undermining audit trails and incident response (GitHub Advisory, Github Advisory DB). Availability is not directly impacted; the primary risks are to confidentiality (unauthorized access to restricted resources) and integrity (log tampering). The impact is most severe in deployments that rely on X-Forwarded-For-derived IPs as a security boundary without additional network-level controls.

The vulnerability is exploitable by any unauthenticated network attacker with no special preconditions beyond the ability to send HTTP requests to the target service. CISA's SSVC assessment (added August 17, 2026) classifies it as automatable with partial technical impact, though no exploitation has been observed (NVD). No public exploit kit or weaponized tooling has been identified beyond the PoC included in the official advisory. The EPSS score is approximately 0.15%, indicating a low near-term exploitation probability (Github Advisory DB). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report.

1. Identify target: Locate a web application built with go-chi/chi versions 0.9.0–5.2.x that uses the middleware.RealIP() middleware and enforces IP-based access controls or relies on logged IPs for security decisions.
2. Craft forged header: Construct an HTTP request with a manipulated X-Forwarded-For header where the first value is the desired spoofed IP address (e.g., an internal or allowlisted IP): X-Forwarded-For: 10.0.0.1, <attacker-real-ip>.
3. Send the request: Transmit the crafted request directly to the target server (e.g., curl http://target.example.com/admin -H 'X-Forwarded-For: 10.0.0.1, 203.0.113.5').
4. Bypass access control: The RealIP middleware reads 10.0.0.1 (the forged first entry) as Request.RemoteAddr, causing IP-allowlist checks to pass as if the request originated from a trusted internal address.
5. Achieve objective: Access restricted endpoints, trigger privileged functionality, or inject false source IPs into audit logs to obscure attacker activity (GitHub Advisory).

• Network: HTTP requests to sensitive or restricted endpoints (e.g., /admin, /internal) containing X-Forwarded-For headers with multiple comma-separated IPs where the first entry is an internal, allowlisted, or otherwise privileged IP address.
• Logs: Access log entries showing requests attributed to internal or trusted IP addresses (e.g., 10.0.0.0/8, 192.168.0.0/16, 127.0.0.1) that do not correspond to actual internal network traffic; discrepancies between the TCP-level source IP and the logged RemoteAddr.
• Application Behavior: Unexpected successful access to IP-restricted resources from external network segments; rate-limit bypasses or repeated access from supposedly different IPs that share the same user-agent or session characteristics.

The primary remediation is to upgrade github.com/go-chi/chi to version 5.3.0 or later, which fixes the RealIP middleware to validate trusted proxies before accepting X-Forwarded-For values (GitHub Advisory, Github Advisory DB). As a workaround prior to upgrading, operators should configure upstream load balancers or reverse proxies to strip or overwrite the X-Forwarded-For header before it reaches the application, ensuring only the proxy-injected value is trusted. Additionally, avoid relying solely on IP-based access controls derived from X-Forwarded-For; supplement with authentication mechanisms that are not spoofable via header manipulation.

The vulnerability was originally reported by researcher convto and published as a GitHub Security Advisory (GHSA-9g5q-2w5x-hmxf) by go-chi maintainer VojtechVitek on May 22, 2026 (GitHub Advisory). VulnCheck assigned the CVE and published a corresponding advisory. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database indexing.