Live › vulnerability › CVE-2026-119711
PipesHub before 0.10.0 trusts client-supplied X-Forwarded-For or X-Real-IP headers when deciding the client IP for rate limiting. An unauthenticated attacker can rotate those header values to get fresh rate-limit buckets, enabling password spraying and flooding of OTP or password-reset emails.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
PipesHub instances before 0.10.0 that rely on per-IP rate limiting for authentication endpoints are exposed, because getClientIp() believes spoofed forwarding headers. Instances on 0.10.0 or later, or where no rate limiting depends on client IP, can skip it. The sources do not say which deployment layouts are most exposed.
No product ranges from the sources yet.
0.10.0 or later is not affected by this flaw; anything earlier is.0.10.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.
This page as .md · .json · in your agent: get_signal("CVE-2026-119711")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.