Medium [CVE-2026-72817] IP spoofing via X-Forwarded-For header manipulation

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request. RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies.

A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs. A flaw was found in the `go-chi/chi` component.

A remote attacker can exploit this by prepending a forged IP address to the `X-Forwarded-For` header, leading to IP spoofing. The middleware parses the first IP address in the `X-Forwarded-For` header without verifying if the immediate HTTP proxy peer is trusted.

An unauthenticated attacker can prepend an arbitrary IP address to the `X-Forwarded-For` header, causing applications relying on `RealIP` for request context to misidentify the client source. This enables bypassing application-level IP-based access control lists (ACLs) or spoofing identity in audit logs.

Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-501.

Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; External Secrets Operator for Red Hat OpenShift; Gatekeeper 3; and 19 more.