CVE-2026-110723
Description
A flaw was found in api-gateway. The default rate-limiting mechanism identifies incoming clients using the X-Forwarded-For network header without verifying the request against a trusted proxy list. A remote attacker can exploit this flaw by sending requests with forged header values to bypass rate-limiting controls, potentially leading to resource exhaustion or service degradation.
Statement
This vulnerability is rated as Moderate severity because while an unauthenticated remote adversary can circumvent request throttling, the flaw does not facilitate arbitrary code execution or compromise sensitive data. In environments operating this gateway service, spoofed proxy forwarding headers allow clients to establish arbitrary tracking buckets, potentially resulting in resource exhaustion or denial of service against underlying backend systems. Eclipse Connected Services Platform api-gateway is not distributed or enabled in supported Red Hat enterprise offerings.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
