CVE-2026-110724 in Connected Services Platform
Summary
by MITRE • 10/15/2026
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability in api-gateway versions up to 1.7.3 represents a critical failure in input validation within the core access control mechanisms, specifically targeting the rate-limiting subsystem. The component responsible for this flaw is the ClientIpKeyResolver, which serves as the default mechanism for determining per-client request buckets. In standard web architectures utilizing reverse proxies or load balancers, the X-Forwarded-For header is commonly used to preserve the original client IP address across multiple hops. However, the implementation in api-gateway incorrectly assumes that the leftmost element of this header always represents a trusted and accurate source identifier. This assumption ignores the fundamental security principle that HTTP headers are user-controlled data unless explicitly validated against a known list of trusted proxies or internal network ranges. By accepting the first value from X-Forwarded-For without verification, the gateway effectively delegates trust to any client capable of crafting custom HTTP requests, thereby undermining the integrity of the rate-limiting logic.
From a technical perspective, this flaw allows an attacker to bypass rate limiting through header manipulation. Since the resolver extracts only the leftmost IP address from the X-Forwarded-For string and does not validate it against a whitelist of trusted proxy IPs or internal subnets, each unique value provided in this header results in the creation of a new, independent rate-limit bucket. An attacker can simply rotate through a large pool of spoofed IP addresses within the X-Forwarded-For header for each request they send to the gateway. Because the system treats each distinct leftmost value as a separate client with its own quota allowance, the aggregate attack traffic is distributed across thousands or millions of virtual buckets. This effectively neutralizes the rate-limiting protection, allowing the attacker to perform high-volume operations such as brute-force attacks, credential stuffing, denial-of-service attempts, or API abuse without triggering any throttling thresholds designed to protect backend services from excessive load.
The operational impact of this vulnerability is severe, particularly for applications relying on api-gateway to enforce fair usage policies and protect against automated abuse. The ability to bypass rate limits means that malicious actors can exhaust backend resources, degrade service availability for legitimate users, or exploit business logic flaws without restriction. This directly impacts the confidentiality, integrity, and availability of the protected services. Furthermore, it undermines compliance with security standards that require robust protection against application-layer attacks. In environments where API endpoints handle sensitive data or financial transactions, this bypass could lead to significant data breaches or financial loss due to unchecked automated exploitation. The lack of validation also indicates a broader architectural weakness in how trust boundaries are defined within the gateway configuration, suggesting that other components might similarly accept untrusted input as authoritative source identifiers.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-749 Exposed Rate Limiting Control, highlighting the failure to restrict operations based on user-supplied data and the exposure of security controls to manipulation. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1583 Acquire Infrastructure, specifically sub-technique T1583.002 Rent a Botnet or using proxy networks for evasion, as well as general abuse of access control mechanisms similar to T1190 Exploit Public-Facing Application. To mitigate this issue, organizations must upgrade to api-gateway version 1.7.4 or later where the default resolver has been patched to validate IP addresses against a trusted proxy list or internal network ranges before using them as rate-limit keys. For systems that cannot immediately upgrade, administrators should configure a custom key resolver that ignores user-supplied X-Forwarded-For headers entirely and instead relies on connection-level attributes such as the actual remote socket address provided by the TCP layer, which is significantly harder to spoof without compromising network infrastructure. Additionally, implementing Web Application Firewall rules can help detect and block requests with suspiciously rotated or malformed forwarding headers before they reach the gateway logic.