{"id":"CVE-2026-119711","kind":"vulnerability","aliases":["CVE-2026-119711"],"related":[],"title":"PipesHub: spoofed forwarding headers bypass per-IP rate limits on login","description":"PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.","summary":"PipesHub before 0.10.0 trusts client-supplied X-Forwarded-For or X-Real-IP headers when deciding the client IP for rate limiting. An unauthenticated attacker can rotate those header values to get fresh rate-limit buckets, enabling password spraying and flooding of OTP or password-reset emails.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authentication","other","pipeshub","self-hosted"],"not_affected_if":["version-0.10.0-or-later"],"how_to_check":"- Check the PipesHub version: `0.10.0` or later is not affected by this flaw; anything earlier is.\n- Look at whether PipesHub sits behind a proxy that sets X-Forwarded-For, and whether rate limits key on the client IP that getClientIp() returns.","fix":"- PipesHub: move to `0.10.0` or later.","status":"open","published_at":"2026-10-30T16:17:54+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:11+00:00","updated_at":"2026-10-30T16:32:11+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T16:32:11Z","model":"claude-haiku-5-5","output":{"fix":"- PipesHub: move to `0.10.0` or later.","reach":"internet","title":"PipesHub: spoofed forwarding headers bypass per-IP rate limits on login","impact":"medium","summary":"PipesHub before 0.10.0 trusts client-supplied X-Forwarded-For or X-Real-IP headers when deciding the client IP for rate limiting. An unauthenticated attacker can rotate those header values to get fresh rate-limit buckets, enabling password spraying and flooding of OTP or password-reset emails.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pipeshub","self-hosted","authentication"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Password spraying and email flooding on authentication endpoints","analyst_note":"","how_to_check":"- Check the PipesHub version: `0.10.0` or later is not affected by this flaw; anything earlier is.\n- Look at whether PipesHub sits behind a proxy that sets X-Forwarded-For, and whether rate limits key on the client IP that getClientIp() returns.\n- unknown for any other check the sources do not give.","plain_action":"","needs_analyst":false,"not_affected_if":["version-0.10.0-or-later"],"who_is_affected":"PipesHub instances before 0.10.0 that rely on per-IP rate limiting for authentication endpoints are exposed, because getClientIp() believes spoofed forwarding headers. Instances on 0.10.0 or later, or where no rate limiting depends on client IP, can skip it. The sources do not say which deployment layouts are most exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4170,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119711':15A,18A '-2026':14A,17A '0.10.0':27B,79C 'allow':89C 'attack':52B,91C,110C 'authent':19B,123C 'bucket':64B,121C 'bypass':5A,84C 'client':30B,45B 'client-suppli':29B 'contain':80C 'cve':13A,16A 'decid':43B 'email':76B,134C 'enabl':65B,125C 'endpoint':124C 'evad':93C 'flood':69B,135C 'forward':3A,34B,102C 'fresh':60B,117C 'get':59B 'getclientip':87C 'header':4A,41B,56B,109C,113C 'host':24B 'ip':8A,40B,46B,96C,108C 'limit':10A,49B,63B,83C,120C 'login':12A 'obtain':116C 'otp':71B,129C 'password':66B,74B,126C,132C 'password-reset':73B,131C 'per':7A,95C 'per-ip':6A,94C 'pipeshub':1A,21B,25B,77C 'rate':9A,48B,62B,82C,119C 'rate-limit':61B,118C 'real':39B,107C 'reset':75B,133C 'rotat':54B,112C 'self':23B 'self-host':22B 'spoof':2A,99C 'spray':67B,127C 'suppli':31B 'throttl':97C 'trust':28B 'unauthent':51B,90C 'valu':57B,114C 'vulner':85C 'x':33B,38B,101C,106C 'x-forwarded-for':32B,100C 'x-real-ip':37B,105C","nicknames":[],"mitigations":[],"who_affected":"PipesHub instances before 0.10.0 that rely on per-IP rate limiting for authentication endpoints are exposed, because getClientIp() believes spoofed forwarding headers. Instances on 0.10.0 or later, or where no rate limiting depends on client IP, can skip it. The sources do not say which deployment layouts are most exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119711","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119711","severity":null,"published_at":"2026-10-30T16:17:54+00:00","modified_at":"2026-10-30T16:17:54+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}