Medium [CVE-2026-72816] IP Spoofing via RealIP Middleware allows bypassing access controls
This medium-severity Red Hat Linux advisory covers CVE-2026-72816 affecting Red Hat Hardened Images, Cryostat 4, External Secrets Operator for Red Hat OpenShift.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy.
Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
This vulnerability allows a remote attacker to perform IP spoofing by supplying arbitrary IP addresses in client-controlled headers. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Weakness: CWE-346.
Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; External Secrets Operator for Red Hat OpenShift; Gatekeeper 3; and 18 more.
- 5.2.1
Official advisory · high-confidence parse· fetched 18 days ago·verify at source
- 5.3.0
- spire1-14-main-1.14.7-0.4.hum1
- spire1-15-main-1.15.2-0.4.hum1
- cosign-main-3.1.3-0.1.hum1
- RHSA-2026:49718
- RHSA-2026:49732
- RHSA-2026:54420
Official advisory · high-confidence parse· fetched 18 days ago·verify at source
Mitigation checklist
- Do not use the `chi/middleware.RealIP` middleware when receiving traffic directly from untrusted networks or unverified proxies. Instead, strip or sanitize client-supplied forwarding headers at an upstream edge proxy or reverse proxy (such as NGINX or HAProxy) before requests reach the application.
Official advisory · high-confidence parse· fetched 18 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.