{"id":"CVE-2026-126400","kind":"vulnerability","aliases":["CVE-2026-126400"],"related":[],"title":"Password Pusher: forged client IP lets attackers falsify audit logs and rate limits","description":"Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits.","summary":"Password Pusher versions from 1.49.0 before 2.17.0 trust X-Forwarded-For headers through an unanchored regular expression, so remote clients can set the recorded request IP. An attacker can falsify audit log entries and shift password generator rate limits.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","password-pusher","ruby","self-hosted"],"not_affected_if":["version-2.17.0-or-later"],"how_to_check":"- Check the installed Password Pusher version; affected if it is from `1.49.0` up to but not including `2.17.0`.\n- Look at the trusted proxy configuration for a regular expression matching proxy addresses; an unanchored pattern is the flawed setting.","fix":"- Upgrade Password Pusher to `2.17.0` or later.","status":"open","published_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","triaged_at":"2026-11-13T10:55:19+00:00","updated_at":"2026-11-13T10:55:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:55:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Password Pusher to `2.17.0` or later.","reach":"internet","title":"Password Pusher: forged client IP lets attackers falsify audit logs and rate limits","impact":"low","summary":"Password Pusher versions from 1.49.0 before 2.17.0 trust X-Forwarded-For headers through an unanchored regular expression, so remote clients can set the recorded request IP. An attacker can falsify audit log entries and shift password generator rate limits.","audience":"businesses","category":"package","nicknames":[],"who_cares":["password-pusher","self-hosted","ruby"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"audit logs falsified and rate limits bypassed by spoofed client IPs","analyst_note":"","how_to_check":"- Check the installed Password Pusher version; affected if it is from `1.49.0` up to but not including `2.17.0`.\n- Look at the trusted proxy configuration for a regular expression matching proxy addresses; an unanchored pattern is the flawed setting.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-2.17.0-or-later"],"who_is_affected":"Teams that self-host Password Pusher with trusted proxy settings in place. The flaw lies in how the trusted-proxy regular expression matches addresses, so any instance that accepts X-Forwarded-For from remote clients is exposed. Managed use of the service by others is not something the sources address.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4640,"output_tokens":570,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126400':16A,19A '-2026':15A,18A '/8':99C,102C '1.49.0':32B,71C '110.0.0.0':98C '2.17.0':34B,73C '210.0.0.0':101C 'allow':80C 'attack':7A,56B 'audit':9A,59B,115C 'client':4A,48B,82C,96C 'connect':104C 'contain':74C 'cve':14A,17A 'direct':105C 'entri':61B,117C 'express':45B,95C 'falsifi':8A,58B,114C 'forg':3A,84C 'forward':38B,110C 'generat':65B,121C 'header':40B 'host':27B 'ip':5A,54B,76C,88C 'let':6A 'limit':13A,67B,123C 'log':10A,60B,116C 'packag':20B 'password':1A,22B,28B,64B,68C,120C 'password-push':21B 'proxi':93C 'pusher':2A,23B,29B,69C 'rate':12A,66B,122C 'record':52B,86C 'regular':44B,94C 'remot':47B,81C 'request':53B,87C 'rubi':24B 'self':26B 'self-host':25B 'set':50B 'shift':63B,119C 'spoof':77C 'suppli':107C 'trust':35B,92C 'trusted-proxi':91C 'unanchor':43B,90C 'valu':112C 'version':30B 'via':89C 'vulner':78C 'x':37B,109C 'x-forwarded-for':36B,108C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Password Pusher with trusted proxy settings in place. The flaw lies in how the trusted-proxy regular expression matches addresses, so any instance that accepts X-Forwarded-For from remote clients is exposed. Managed use of the service by others is not something the sources address.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","passwordpusher","ruby","selfhosted"],"campaign_type":null,"search_a":"'-126400':16A,19A '-2026':15A,18A 'attack':7A 'audit':9A 'client':4A 'cve':14A,17A 'falsifi':8A 'forg':3A 'ip':5A 'let':6A 'limit':13A 'log':10A 'password':1A 'pusher':2A 'rate':12A","search_b":"'1.49.0':32B '2.17.0':34B 'attack':56B 'audit':59B 'client':48B 'entri':61B 'express':45B 'falsifi':58B 'forward':38B 'generat':65B 'header':40B 'host':27B 'ip':54B 'limit':67B 'log':60B 'packag':20B 'password':22B,28B,64B 'password-push':21B 'pusher':23B,29B 'rate':66B 'record':52B 'regular':44B 'remot':47B 'request':53B 'rubi':24B 'self':26B 'self-host':25B 'set':50B 'shift':63B 'trust':35B 'unanchor':43B 'version':30B 'x':37B 'x-forwarded-for':36B","search_c":"'/8':99C,102C '1.49.0':71C '110.0.0.0':98C '2.17.0':73C '210.0.0.0':101C 'allow':80C 'audit':115C 'client':82C,96C 'connect':104C 'contain':74C 'direct':105C 'entri':117C 'express':95C 'falsifi':114C 'forg':84C 'forward':110C 'generat':121C 'ip':76C,88C 'limit':123C 'log':116C 'password':68C,120C 'proxi':93C 'pusher':69C 'rate':122C 'record':86C 'regular':94C 'remot':81C 'request':87C 'shift':119C 'spoof':77C 'suppli':107C 'trust':92C 'trusted-proxi':91C 'unanchor':90C 'valu':112C 'via':89C 'vulner':78C 'x':109C 'x-forwarded-for':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T14:59:47+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126400","severity":null,"published_at":"2026-11-13T10:17:44+00:00","modified_at":"2026-11-13T10:17:44+00:00","first_seen_at":"2026-11-13T10:47:19+00:00","fetched_at":"2026-11-13T10:47:19+00:00","note":null}],"documents":[{"id":145043,"url":"https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-p2xh-x263-68qc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T14:59:47+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145044,"url":"https://www.vulncheck.com/advisories/password-pusher-1.49.0-before-2.17.0-ip-spoofing-via-unanchored-trusted-proxy-regex","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}