CVE-2026-114437: Chi Client IP Spoofing in ClientIPFromXFF via X-Forwarded-For

Deferred

AliasesDEBIAN-CVE-2026-114437UBUNTU-CVE-2026-114437GHSA-j6qf-3m9c-vwj3+367 more

Published 21-10-2026Last modified 21-10-2026

Vulnerability summary

CVE-2026-114437 is a medium (CVSS 6.3) Use of Less Trusted Source vulnerability in go-chi chi. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.5% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.3/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.13%

0%100%

Low · Change unavailable

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2026:22201-1

Timeline

21-10-2026
PublishedVulnerability first disclosed.
21-10-2026
Last modifiedVulnerability information updated.

Description

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

CVSS metrics

10 scores · 7 sources · 2 versions

v4.06.3v3.14.8

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

Versus all other CVEs

30-day change

Change unavailable

22-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

apply-cve-bumpAll versions (No fix recorded) | < 0.2.390-r1
aws-lambda-runtime-interface-emulatorAll versions (No fix recorded) | < 1.37-r6
aws-lambda-runtime-interface-emulator-fipsAll versions (No fix recorded) | < 1.37-r9
buildkite-agent-3All versions (No fix recorded) | < 3.138.2-r1
buildkite-agent-fips-3All versions (No fix recorded) | < 3.138.2-r2

caddyAll versions (No fix recorded) | < 2.11.7-r6
caddy-fipsAll versions (No fix recorded) | < 2.11.7-r8
cgAll versions (No fix recorded) | < 0.2.390-r1
chainctlAll versions (No fix recorded) | < 0.2.390-r1
chainctl-fipsAll versions (No fix recorded) | < 0.2.391-r1
chainloop-cli< 1.127.4-r1
chainloop-cli-fipsAll versions (No fix recorded) | < 1.127.4-r1
chainloop-control-planeAll versions (No fix recorded) | < 1.127.4-r1
chainloop-control-plane-fipsAll versions (No fix recorded) | < 1.127.4-r1
cloudflaredAll versions (No fix recorded) | < 2026.10.3-r1
cloudflared-fipsAll versions (No fix recorded) | < 2026.10.3-r1
coder-2.33< 2.33.11-r20
coder-2.34All versions (No fix recorded) | < 2.34.14-r1
coder-fips-2.29All versions (No fix recorded) | < 2.29.22-r2
coder-fips-2.32All versions (No fix recorded) | < 2.32.10-r17
coder-fips-2.33< 2.33.11-r19
coder-fips-2.34All versions (No fix recorded) | < 2.34.14-r1
commercial-chainloop-backendAll versions (No fix recorded)
commercial-chainloop-cliAll versions (No fix recorded)
commercial-kyverno-1.14All versions (No fix recorded)
commercial-kyverno-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.14All versions (No fix recorded)
commercial-kyverno-background-controller-1.16All versions (No fix recorded)
commercial-kyverno-background-controller-1.17All versions (No fix recorded)
commercial-kyverno-background-controller-1.18All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.14All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.16All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.17All versions (No fix recorded)
commercial-kyverno-cleanup-controller-1.18All versions (No fix recorded)
commercial-kyverno-cli-1.18All versions (No fix recorded)
commercial-kyverno-reports-controller-1.16All versions (No fix recorded)
commercial-kyverno-reports-controller-1.17All versions (No fix recorded)
commercial-kyverno-reports-controller-1.18All versions (No fix recorded)
commercial-kyvernopre-1.14All versions (No fix recorded)
commercial-kyvernopre-1.16All versions (No fix recorded)
commercial-kyvernopre-1.17All versions (No fix recorded)
commercial-kyvernopre-1.18All versions (No fix recorded)
continuityAll versions (No fix recorded) | < 0.11.0-r8
cortexAll versions (No fix recorded) | < 1.21.1-r20
cortex-fipsAll versions (No fix recorded) | < 1.21.1-r20
cortex-geomys-fipsAll versions (No fix recorded) | < 1.21.1-r14
cosign-2All versions (No fix recorded) | < 2.6.5-r11
cosign-3All versions (No fix recorded) | < 3.1.4-r2
cosign-fips-2All versions (No fix recorded) | < 2.6.5-r11
cosign-fips-3All versions (No fix recorded) | < 3.1.4-r1
cosmo-routerAll versions (No fix recorded) | < 0.363.0-r1
cosmo-router-fipsAll versions (No fix recorded) | < 0.363.0-r1
crossplane-2.0All versions (No fix recorded) | < 2.0.8-r32
crossplane-2.1All versions (No fix recorded) | < 2.1.8-r16
crossplane-2.2All versions (No fix recorded) | < 2.2.6-r6
crossplane-2.2-crank< 2.2.6-r6
crossplane-2.3All versions (No fix recorded) | < 2.3.7-r1
crossplane-2.4All versions (No fix recorded) | < 2.4.3-r1
crossplane-cli-2.3All versions (No fix recorded) | < 2.3.4-r23
crossplane-cli-2.4All versions (No fix recorded) | < 2.4.1-r15
crossplane-cli-fips-2.3All versions (No fix recorded) | < 2.3.4-r22
crossplane-cli-fips-2.4< 2.4.1-r16
crossplane-fips-2.0All versions (No fix recorded) | < 2.0.8-r33
crossplane-fips-2.1All versions (No fix recorded) | < 2.1.8-r18
crossplane-fips-2.2-crankAll versions (No fix recorded) | < 2.2.7-r1
crossplane-fips-2.3All versions (No fix recorded) | < 2.3.7-r1
crossplane-fips-2.4< 2.4.3-r1
dapr-daprd-1.15< 1.15.14-r22
dapr-daprd-1.16All versions (No fix recorded) | < 1.16.21-r1
dapr-daprd-1.17All versions (No fix recorded) | < 1.17.18-r1
dapr-daprd-1.18All versions (No fix recorded) | < 1.18.9-r1
dapr-daprd-1.19All versions (No fix recorded) | < 1.19.0-r1
dapr-daprd-fips-1.15All versions (No fix recorded) | < 1.15.14-r24
dapr-daprd-fips-1.16All versions (No fix recorded) | < 1.16.21-r1
dapr-daprd-fips-1.17< 1.17.18-r1
dapr-daprd-fips-1.19All versions (No fix recorded) | < 1.19.0-r1
droneAll versions (No fix recorded) | < 3.3.0-r31
drone-fipsAll versions (No fix recorded) | < 3.3.0-r31
falcoctlAll versions (No fix recorded) | < 0.14.2-r6
falcoctl-fipsAll versions (No fix recorded) | < 0.14.2-r6
fleet-server-8.19< 8.19.23-r5
fleet-server-9.2All versions (No fix recorded) | < 9.2.8-r20
fleet-server-9.3All versions (No fix recorded) | < 9.3.8-r13
fleet-server-9.4All versions (No fix recorded) | < 9.4.8-r6
fleet-server-9.5All versions (No fix recorded) | < 9.5.5-r7
fleet-server-fips-8.19All versions (No fix recorded) | < 8.19.23-r7
fleet-server-fips-9.2< 9.2.8-r20
fleet-server-fips-9.3All versions (No fix recorded) | < 9.3.8-r13
fleet-server-fips-9.4All versions (No fix recorded) | < 9.4.8-r6
fleet-server-fips-9.5< 9.5.5-r6
fluxcd-kustomize-mutating-webhook< 0.12.1-r4
fluxcd-kustomize-mutating-webhook-fips< 0.12.1-r5
gitea< 28.2.0-r2
gitea-fipsAll versions (No fix recorded) | < 28.2.0-r2
github-mcp-server< 2.0.3-r2
gitnessAll versions (No fix recorded) | < 3.3.0-r47
gitsignAll versions (No fix recorded) | < 0.18.0-r2
gogatekeeperAll versions (No fix recorded) | < 5.0.1-r2
gotrue< 2.197.0-r7
gotrue-fipsAll versions (No fix recorded) | < 2.197.0-r6
image-factoryAll versions (No fix recorded) | < 1.7.2-r5
image-factory-fipsAll versions (No fix recorded) | < 1.7.2-r5
kubescapeAll versions (No fix recorded) | < 4.0.16-r2
kubescape-server-fipsAll versions (No fix recorded) | < 4.0.16-r3
kubescape-server-fips-downloader< 4.0.16-r3
kyverno-1.15All versions (No fix recorded) | < 1.15.3-r42
kyverno-1.17All versions (No fix recorded) | < 1.17.2-r42
kyverno-1.18< 1.18.2-r21
kyverno-background-controller-1.15< 1.15.3-r42
kyverno-background-controller-1.17< 1.17.2-r42
kyverno-background-controller-1.18All versions (No fix recorded) | < 1.18.2-r21
kyverno-background-controller-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-background-controller-fips-1.15All versions (No fix recorded) | < 1.15.20-r27
kyverno-background-controller-fips-1.16All versions (No fix recorded)
kyverno-background-controller-fips-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-background-controller-fips-1.18All versions (No fix recorded) | < 1.18.2-r27
kyverno-background-controller-fips-1.19< 1.19.2-r1
kyverno-cleanup-controller-1.15All versions (No fix recorded) | < 1.15.3-r42
kyverno-cleanup-controller-1.17All versions (No fix recorded) | < 1.17.2-r42
kyverno-cleanup-controller-fips-1.15All versions (No fix recorded) | < 1.15.20-r27
kyverno-cleanup-controller-fips-1.16All versions (No fix recorded)
kyverno-cleanup-controller-fips-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-cleanup-controller-fips-1.18All versions (No fix recorded) | < 1.18.2-r27
kyverno-cleanup-controller-fips-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-cli-1.15All versions (No fix recorded) | < 1.15.3-r42
kyverno-cli-1.17All versions (No fix recorded) | < 1.17.2-r42
kyverno-cli-1.18All versions (No fix recorded)
kyverno-cli-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-cli-fips-1.15All versions (No fix recorded) | < 1.15.20-r27
kyverno-cli-fips-1.16All versions (No fix recorded)
kyverno-cli-fips-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-cli-fips-1.18All versions (No fix recorded) | < 1.18.2-r27
kyverno-cli-fips-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-fips-1.15All versions (No fix recorded) | < 1.15.20-r27
kyverno-fips-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-fips-1.18All versions (No fix recorded) | < 1.18.2-r27
kyverno-fips-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-init-container-1.15All versions (No fix recorded) | < 1.15.3-r42
kyverno-init-container-1.17All versions (No fix recorded) | < 1.17.2-r42
kyverno-init-container-1.18All versions (No fix recorded) | < 1.18.2-r21
kyverno-init-container-fips-1.15All versions (No fix recorded) | < 1.15.20-r27
kyverno-init-container-fips-1.16All versions (No fix recorded)
kyverno-init-container-fips-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-init-container-fips-1.18All versions (No fix recorded) | < 1.18.2-r27
kyverno-init-container-fips-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-notation-awsAll versions (No fix recorded) | < 1.1-r85
kyverno-notation-aws-fips< 1.1-r77
kyverno-policy-reporter-uiAll versions (No fix recorded) | < 2.9.0-r6
kyverno-policy-reporter-ui-fips< 2.9.0-r5
kyverno-reports-controller-1.16All versions (No fix recorded) | < 1.16.4-r39
kyverno-reports-controller-1.17All versions (No fix recorded) | < 1.17.2-r42
kyverno-reports-controller-1.18All versions (No fix recorded) | < 1.18.2-r21
kyverno-reports-controller-1.19All versions (No fix recorded) | < 1.19.2-r1
kyverno-reports-controller-fips-1.15All versions (No fix recorded) | < 1.15.20-r27
kyverno-reports-controller-fips-1.16All versions (No fix recorded)
kyverno-reports-controller-fips-1.17All versions (No fix recorded) | < 1.17.2-r35
kyverno-reports-controller-fips-1.18All versions (No fix recorded) | < 1.18.2-r27
kyverno-reports-controller-fips-1.19< 1.19.2-r1
llm-d-router-coordinatorAll versions (No fix recorded) | < 1.0.0-r1
llm-d-router-coordinator-fipsAll versions (No fix recorded) | < 1.0.0-r2
mariadb-operatorAll versions (No fix recorded) | < 26.10.2-r1
mariadb-operator-fips< 26.10.2-r1
neuvector-sigstore-interfaceAll versions (No fix recorded) | < 4.307-r1
neuvector-sigstore-interface-fipsAll versions (No fix recorded) | < 4.309-r1
nuclio-controllerAll versions (No fix recorded) | < 1.17.10-r3
nuclio-controller-fipsAll versions (No fix recorded) | < 1.17.10-r4
nuclio-dashboardAll versions (No fix recorded) | < 1.17.10-r3
nuclio-dashboard-fipsAll versions (No fix recorded) | < 1.17.10-r4
omniAll versions (No fix recorded) | < 1.12.4-r6
omni-fips< 1.12.4-r6
policy-controllerAll versions (No fix recorded) | < 0.15.1-r33
policy-controller-tester< 0.15.1-r33
pyrraAll versions (No fix recorded) | < 0.10.2-r4
pyrra-fipsAll versions (No fix recorded) | < 0.10.2-r7
ratify< 1.4.8-r1
ratify-fips< 1.4.8-r1
rcloneAll versions (No fix recorded) | < 1.75.2-r3
rclone-fipsAll versions (No fix recorded) | < 1.75.2-r4
redpanda-console-2.8All versions (No fix recorded) | < 2.8.17-r1
redpanda-console-3.10< 3.10.0-r12
redpanda-console-3.11All versions (No fix recorded) | < 3.11.0-r11
redpanda-console-3.12All versions (No fix recorded) | < 3.12.0-r6
redpanda-console-3.13All versions (No fix recorded) | < 3.13.0-r2
redpanda-console-fips-2.8< 2.8.17-r1
redpanda-console-fips-3.10All versions (No fix recorded) | < 3.10.0-r8
redpanda-console-fips-3.11All versions (No fix recorded) | < 3.11.0-r9 | < 3.11.0-r10
redpanda-console-fips-3.12All versions (No fix recorded) | < 3.12.0-r7
redpanda-console-fips-3.13All versions (No fix recorded) | < 3.13.1-r2
redpanda-operatorAll versions (No fix recorded) | < 26.2.4-r6
redpanda-operator-25.1All versions (No fix recorded) | < 25.1.4-r29
redpanda-operator-25.2All versions (No fix recorded) | < 25.2.6-r24
redpanda-operator-25.3< 25.3.11-r1
redpanda-operator-26.1All versions (No fix recorded) | < 26.1.12-r6
redpanda-operator-26.2< 26.2.4-r6
sftpgo< 2.7.6-r4
slothAll versions (No fix recorded) | < 0.16.0-r3
sloth-fips< 0.16.0-r3
slsa-verifierAll versions (No fix recorded) | < 2.7.1-r38
spire-agentAll versions (No fix recorded) | < 1.15.5-r1
spire-agent-fipsAll versions (No fix recorded) | < 1.15.5-r2