CVE-2026-110726
Description
A flaw was found in api-gateway. The default client IP resolution derives rate-limiting keys directly from the client-supplied X-Forwarded-For header without verifying trusted proxies. A remote attacker can exploit this flaw by sending HTTP requests with spoofed header values to allocate new rate-limit buckets. This allows the attacker to bypass request-rate limiting entirely, potentially leading to resource exhaustion or Denial of Service (DoS).
Statement
This vulnerability is rated as a Moderate impact because while an unauthenticated remote actor can evade traffic throttling by forging HTTP proxy headers, exploitation is limited to circumventing rate limits and does not allow unauthorized data disclosure or arbitrary code execution. The flaw only manifests in environments where routes rely on default client IP resolution without upstream proxy validation to restrict header injection. Red Hat enterprise offerings do not distribute the Eclipse ECSP api-gateway service, resulting in minimal overall risk to supported product environments.
Understanding the Weakness (CWE)
Confidentiality,Access Control,Availability
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity; Varies by Context
When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the product to access whatever is being protected. An attacker could change these inputs using customized clients or other attacks. This change might not be detected. The consequences will depend on the associated functionality, but they can range from granting additional privileges to untrusted users to bypassing important security checks. Ultimately, this weakness may lead to exposure or modification of sensitive data, system crash, or execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
