CVE-2026-72817: 
Prometheus vulnerability analysis and mitigation

CVE-2026-72817 is an IP spoofing vulnerability in the RealIP middleware of the go-chi/chi Go web framework. The middleware resolves the request source IP (Request.RemoteAddr) by blindly trusting the first IP in the X-Forwarded-For header without validating whether the request originated from a trusted proxy. All versions from 0.9.0 up to (but not including) 5.3.0 are affected. The vulnerability was published on August 14, 2026, with a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (GitHub Advisory, chi Security Advisory).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). The vulnerable RealIP() middleware implementation splits the X-Forwarded-For header by comma and uses the first IP as the authoritative client IP, without verifying that the request passed through a trusted proxy (chi Security Advisory). Because the X-Forwarded-For header is client-controlled, an attacker can prepend any arbitrary IP address as the first value; a legitimate proxy then appends the real client IP, but the server reads only the attacker-supplied first entry. The correct approach — as implemented by frameworks like labstack/echo — is to traverse the header from right to left, skipping known trusted proxy IPs, and treating the first untrusted IP as the real client source (chi Security Advisory). A public proof-of-concept is included in the security advisory, demonstrating exploitation with a simple curl command (chi Security Advisory).

Successful exploitation allows an unauthenticated network attacker to spoof the apparent source IP of any HTTP request processed by the vulnerable middleware. This can lead to bypass of IP-based access controls (e.g., allowlists or denylists enforced on Request.RemoteAddr) and falsification of request logs, undermining audit trails and forensic integrity. Availability is not impacted, but both confidentiality and integrity are partially affected — an attacker may gain unauthorized access to restricted resources or obscure their true identity in logs (GitHub Advisory, chi Security Advisory).

No evidence of active in-the-wild exploitation has been observed, and no weaponized exploit kits are known to incorporate this vulnerability (GitHub Advisory). A functional proof-of-concept is publicly available in the original security advisory, demonstrating the attack with a single curl command. The EPSS score is approximately 0.15%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" at this time, though the attack is rated as automatable (GitHub Advisory).

1. Identify target: Locate a web application built with go-chi/chi versions 0.9.0–5.2.x that uses the RealIP middleware and enforces IP-based access controls or relies on Request.RemoteAddr for logging/authorization.
2. Craft malicious request: Construct an HTTP request with a forged IP prepended to the X-Forwarded-For header, e.g., X-Forwarded-For: <spoofed-IP>, <real-client-IP>.
3. Send request through a proxy: Route the request through any intermediary proxy (or send directly if no proxy validation is enforced). The proxy appends the real client IP, resulting in a header like X-Forwarded-For: 192.0.2.1, <actual-attacker-IP>.
4. Trigger middleware processing: The RealIP() middleware reads the first IP (192.0.2.1) and sets it as Request.RemoteAddr, overwriting the true client IP.
5. Bypass access control or falsify logs: The application now treats the forged IP as the client source, potentially granting access to IP-restricted resources or recording the false IP in audit logs.

Example curl command: curl http://target-app/ -H 'X-Forwarded-For: 192.0.2.1, <attacker-real-ip>' (chi Security Advisory).

• Network: HTTP requests containing X-Forwarded-For headers with multiple comma-separated IP addresses where the first IP is a known allowlisted or internal address, originating from unexpected external sources.
• Logs: Application access logs showing Request.RemoteAddr values that are internal, loopback, or allowlisted IPs for requests that should not originate from those addresses; discrepancies between the TCP connection source IP and the logged client IP.
• Logs: Repeated access to IP-restricted endpoints from IPs that appear on allowlists but are inconsistent with expected traffic patterns or geographic origin.
• Application Behavior: Successful authentication or authorization for IP-restricted resources from unexpected network locations, particularly if the application logs show an allowlisted IP but network-layer logs show a different source.

Upgrade go-chi/chi to version 5.3.0 or later, which fixes the RealIP middleware to properly validate trusted proxies before accepting X-Forwarded-For values (chi Security Advisory, GitHub Advisory). As a workaround prior to upgrading, configure upstream infrastructure (load balancers, reverse proxies) to strip or overwrite the X-Forwarded-For header before it reaches the application, ensuring only trusted proxy IPs can set this header. Additionally, avoid relying solely on Request.RemoteAddr for security-critical access control decisions without independent network-layer enforcement.

The vulnerability was originally reported by researcher convto and published by VojtechVitek via the go-chi/chi GitHub security advisory on May 22, 2026 (chi Security Advisory). Microsoft acknowledged the vulnerability in its Security Response Center update guide, reflecting its impact on Azure Linux packages (Microsoft MSRC). OpenSUSE also issued a security announcement addressing the vulnerability in its packages (GitHub Advisory). No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries.