CVE-2026-126400 · Package
NO FIX YET · SEE WHAT TO DO
Password Pusher versions from 1.49.0 before 2.17.0 trust X-Forwarded-For headers through an unanchored regular expression, so remote clients can set the recorded request IP. An attacker can falsify audit log entries and shift password generator rate limits.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that self-host Password Pusher with trusted proxy settings in place. The flaw lies in how the trusted-proxy regular expression matches addresses, so any instance that accepts X-Forwarded-For from remote clients is exposed. Managed use of the service by others is not something the sources address.
Not affected if version-2.17.0-or-later
Who cares password-pusher, ruby, self-hosted
1.49.0 up to but not including 2.17.0.2.17.0 or later.Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.