CVE-2026-110723 in Connected Services Platform
Summary
by MITRE • 10/15/2026
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability in api-gateway versions up to 1.7.3 represents a critical failure in input validation within the default rate-limiting mechanism, specifically affecting the ClientIpKeyResolver component. This resolver is designed to enforce request-rate limits by assigning each unique client an independent bucket of allowed requests per time window. The technical flaw lies in how this identifier is derived: it relies entirely on the leftmost element of the X-Forwarded-For HTTP header without performing any validation against a trusted proxy list or verifying the authenticity of the source IP address. In standard reverse-proxy architectures, the X-Forwarded-For header is typically appended by intermediate proxies to track the original client's IP as requests traverse multiple hops. However, because this implementation treats the leftmost value as authoritative regardless of its origin, it fails to distinguish between legitimate proxy-added values and maliciously crafted headers injected directly by an attacker at the edge of the network.
This architectural oversight allows a single attacker to bypass rate-limiting controls completely through header manipulation. By sending requests with varying X-Forwarded-For headers, each containing a different leftmost IP address, the attacker can generate as many independent rate-limit buckets as desired. Since the gateway associates limits with these fabricated identifiers rather than the actual source IP of the connection, the throttling mechanism becomes ineffective against distributed or even single-source attacks that utilize header spoofing. This effectively neutralizes one of the primary defenses against denial-of-service conditions and brute-force attempts, leaving backend services exposed to excessive load and potential resource exhaustion without triggering any protective thresholds configured in the gateway.
From a classification perspective, this vulnerability aligns with CWE-749: Exposed Dangerous Method or Function, as it involves improper exposure of internal security controls due to misconfiguration, but more accurately fits CWE-601: URL Redirection to Untrusted Site via User-Controlled Query Parameter in the context of header manipulation. It also maps directly to MITRE ATT&CK technique T1583.002: Acquire Infrastructure: Virtual Private Server or Cloud Instance, as attackers can leverage this flaw to simulate multiple distinct clients for abuse purposes, and potentially T1496: Resource Hijacking if the goal is to exhaust backend resources through unthrottled requests. The core issue stems from a lack of trust boundary enforcement where user-supplied data is treated as authoritative without verification against known infrastructure components.
To mitigate this vulnerability, organizations must update api-gateway installations to version 1.7.4 or later, which addresses the logic flaw in the ClientIpKeyResolver by implementing proper validation against trusted proxy lists. In environments where upgrading is not immediately feasible, administrators should configure a custom key resolver that ignores the X-Forwarded-For header for rate-limiting purposes and instead relies on the actual remote address of the TCP connection or validates headers strictly based on known internal proxy IPs. Additionally, network-level controls such as Web Application Firewalls can be configured to strip or normalize suspiciously varied X-Forwarded-For headers before they reach the gateway, adding a layer of defense-in-depth against header injection attacks. Regular auditing of rate-limiting configurations and ensuring that security mechanisms rely on immutable connection attributes rather than mutable HTTP headers is essential for maintaining robust API protection strategies.