Read the docs
TI-2026-51041 Aliases CVE-2026-72815GHSA-qgxv-hqxp-4rcx

go-chi chi v5.2.1 IP Spoofing via X-Forwarded-For Header

Priority HIGH 70CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 fixed, 17 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-290.

Summary

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Partial chi (go-chi): 5.3.0Red Hat: 4 advisoriesRed Hat: 1 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-chichi5.2.1 to before 5.3.05.3.0Patch availableCNA
  • chi Vendorgo-chi Affected 5.2.1 to before 5.3.0 Fixed in 5.3.0 Patch available CNA

Remediation

  • Fix · CNA chi (go-chi) Fixed in 5.3.0

Red Hat 4 advisories

  • RHSA-2026:54420 Released 2026-08-12 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images cosign-3.1.3-0.1.hum1@aarch64, cosign-3.1.3-0.1.hum1@src, cosign-3.1.3-0.1.hum1@x86_64
  • RHSA-2026:50287 Released 2026-08-04 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images prometheus3.13-3.13.2-0.2.hum1@aarch64, prometheus3.13-3.13.2-0.2.hum1@src, prometheus3.13-3.13.2-0.2.hum1@x86_64
  • RHSA-2026:49732 Released 2026-08-03 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images spire1.15-1.15.2-0.4.hum1@aarch64, spire1.15-1.15.2-0.4.hum1@src, spire1.15-1.15.2-0.4.hum1@x86_64 +6
Show 1 more Red Hat advisories
  • RHSA-2026:49718 Released 2026-08-03 · Red Hat rating Moderate
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images spire1.14-1.14.7-0.4.hum1@aarch64, spire1.14-1.14.7-0.4.hum1@src, spire1.14-1.14.7-0.4.hum1@x86_64 +6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    go-chi chi 5.3.0

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2026-51042 go-chi chi before 5.3.0 IP Spoofing via RealIP MiddlewarePriority HIGH 70
    • TI-2026-51043 go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-ForPriority LOW 36
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Cryostat 4AffectedNo fix yet: Fix deferred
External Secrets Operator for Red Hat OpenShiftAffectedNo fix yet: Fix deferred
Gatekeeper 3AffectedNo fix yet: Fix deferred
Migration Toolkit for Applications 8AffectedNo fix yet: Fix deferred
OpenShift PipelinesAffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Security 4AffectedNo fix yet: Fix deferred
Red Hat Edge Manager 1AffectedNo fix yet: Fix deferred
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Red Hat OpenShift distributed tracing 3AffectedNo fix yet: Fix deferred
Red Hat Satellite 6AffectedNo fix yet: Fix deferred
Red Hat Trusted Artifact SignerAffectedNo fix yet: Fix deferred
Security Profiles OperatorAffectedNo fix yet: Fix deferred
Zero Trust Workload Identity ManagerAffectedNo fix yet: Fix deferred
Zero Trust Workload Identity Manager - Tech PreviewAffectedNo fix yet: Fix deferred
Red Hat Hardened ImagesFixed RHSA-2026:49718, RHSA-2026:49732, RHSA-2026:50287, RHSA-2026:54420
Not affected: 8 products
  • Logging Subsystem for Red Hat OpenShift
  • Multicluster Engine for Kubernetes
  • OpenShift Serverless
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images
  • Red Hat OpenShift Dev Spaces
  • Red Hat Quay 3
  • Red Hat Web Terminal

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-72815
  2. 2026-10-03 Alias added: GHSA-qgxv-hqxp-4rcx
  3. 2026-10-30 Affected versions changed · Red Hat

References

Advisory 1

  • TI-2026-51042 go-chi chi before 5.3.0 IP Spoofing via RealIP Middleware CVSS 4.0MEDIUM 6.9
  • TI-2026-82170 Authentication bypass in go-chi chi SupressNotFound middleware CVSS 4.0MEDIUM 6.3
  • TI-2026-78796 Client IP spoofing in Go chi ClientIPFromXFF middleware CVSS 4.0MEDIUM 6.3
  • TI-2026-85173 Open redirect in go-chi chi RedirectSlashes middleware CVSS 4.0MEDIUM 5.1
  • TI-2025-43521 go-chi chi before v5.2.2 Open Redirect via RedirectSlashes CVSS 4.0MEDIUM 5.1
  • TI-2026-51043 go-chi chi 0.9.0 before 5.3.0 IP Spoofing via X-Forwarded-For CVSS 4.0MEDIUM 6.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences