CVE-2026-110724
UnknownSummary
In `api-gateway` versions up to `1.7.3`, the default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Risk Assessment
An attacker can bypass the API gateway's request-rate limiting, enabling brute-force attacks, denial-of-service flooding, or abuse of protected resources without restriction. This can lead to backend overload and service availability disruption.
Recommendation
Update `api-gateway` to a version later than `1.7.3`, or change the rate-limit key resolver configuration to use a trusted source of the client IP (e.g., a validated proxy chain) instead of the raw `X-Forwarded-For` header. Ensure the gateway accepts forwarded headers only from trusted proxies.
Other vulnerabilities in api-gateway
See all- CVE-2026-110723High
In api-gateway versions till 1.7.3, the default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- CVE-2026-110726Medium
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
- CVE-2024-38487High
The api-gateway container running with root privileges allows an attacker to escape the container and access the host system to perform unintended actions.
- CVE-2026-11815Medium
An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deserialize arbitrary objects. This vulnerability could lead to broken security expectations or remote code execution.
Original NVD description (English source)
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS