TI-2026-41708 Aliases CVE-2026-57942 GHSA-4rjg-9qq9-25m8

LibreTranslate - IP Spoofing via X-Forwarded-For Header

HIGH 70CWE-348Published 2026-06-29 · Updated 2026-06-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00234 14th percentileScored 2026-11-07

Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
LibreTranslate	LibreTranslate	up to 1.9.7	—	Patch available	CNA

LibreTranslate VendorLibreTranslate Affected up to 1.9.7 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-57942
2026-10-03 Alias added: GHSA-4rjg-9qq9-25m8

References

Patch 1

Patch Commit

Other 2

TI-2026-62542 LibreTranslate through 1.9.6 Missing Access Check on the download_file Route CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences