TI-2026-70715 CVE-2026-108736 · GHSA-5mh8-m8gg-2f9w
IP allowlist bypass in Speedtest Tracker via X-Forwarded-For spoofing
Priority LOW 27
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers.