CVE-2026-72816 in chi
Summary
by MITRE • 08/14/2026
go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability in go-chi/chi versions through 5.2.1 represents a critical security flaw within the RealIP middleware component that directly impacts network access control mechanisms. This issue resides in the realIP() function located within middleware/realip.go, where the implementation fails to properly validate the authenticity of client-provided IP address information. The vulnerability specifically affects three HTTP headers: True-Client-IP, X-Real-IP, and X-Forwarded-For, which are commonly used by web applications to determine the original client IP address when requests pass through proxies or load balancers. The flaw stems from the middleware's assumption that all incoming values from these headers can be trusted without proper verification of the request source.
The technical implementation of this vulnerability allows attackers to manipulate the remote address resolution process by injecting malicious IP addresses into the designated headers. When an attacker crafts a request with forged values in these headers, the realIP() function processes them without validating whether the request originates from a known and trusted proxy server within the application's infrastructure. This creates a dangerous situation where unauthenticated parties can assert any IP address they choose, effectively bypassing security controls that rely on IP-based restrictions. The vulnerability operates at the network layer of application security, allowing for arbitrary IP spoofing that can compromise multiple security mechanisms simultaneously.
The operational impact of this vulnerability extends beyond simple access control bypasses and creates significant risks for applications relying on IP-based security measures. Attackers exploiting this flaw can circumvent rate limiting protections that typically restrict API usage or login attempts based on IP addresses, potentially enabling brute force attacks or denial of service scenarios. The ability to manipulate geo-IP restrictions means malicious actors can appear to originate from different geographical locations, undermining location-based access controls and compliance requirements. Additionally, audit logs become corrupted with false IP addresses, making security investigations and forensic analysis substantially more difficult. This vulnerability directly relates to CWE-284 Access Control Issues and represents a classic example of improper input validation that allows privilege escalation through spoofed identity information.
Organizations using affected versions of go-chi/chi should immediately implement mitigation strategies to protect their applications from potential exploitation. The most effective immediate solution involves upgrading to version 5.3.0 or later, which contains the necessary fixes to properly validate proxy sources before accepting IP address information from client headers. Security teams should also consider implementing additional network-level controls such as restricting direct access to application servers and ensuring that only trusted proxies can communicate with backend services. The fix implemented in version 5.3.0 addresses this vulnerability by introducing proper validation of the request source before processing potentially malicious IP addresses from HTTP headers, aligning with ATT&CK technique T1566.002 Spoof Client IP Address and reinforcing proper access control implementation patterns. Network administrators should also consider implementing additional logging and monitoring for suspicious header values to detect potential exploitation attempts.
This vulnerability demonstrates the critical importance of proper input validation in web application security frameworks, particularly when dealing with information that can be manipulated by untrusted parties. The issue highlights how seemingly innocuous middleware components can create significant security weaknesses when they fail to properly validate the authenticity of information passed through HTTP headers. Organizations should conduct thorough security reviews of their web application frameworks and middleware components to identify similar vulnerabilities that might allow for IP address manipulation or other forms of identity spoofing attacks. The remediation approach required for this vulnerability emphasizes the need for comprehensive security testing that includes validation of header-based IP address handling in all network-facing applications, particularly those relying on proxy configurations for proper access control enforcement.