{"id":"CVE-2026-77463","kind":"vulnerability","aliases":["CVE-2026-77463"],"related":[],"title":"Remark42: forged proxy headers bypass rate limits and vote checks","description":"Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology.","summary":"Remark42, a self-hosted blog comment engine, trusts client-supplied True-Client-IP, X-Real-IP and X-Forwarded-For headers without checking the sender is a trusted proxy. A remote attacker can rotate those headers to dodge per-IP rate limits and vote de-duplication, mint anonymous identities, and write fake IPs into stored comments and logs.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["blogs","package","remark42","self-hosted"],"not_affected_if":["no-direct-internet-exposure","trusted-proxy-configured","version-1.16.2-or-later"],"how_to_check":"- Check the Remark42 version in use: `remark42 --version` or the image tag; versions from `1.0.0` through `1.16.2` are affected.\n- Check whether the deployment sets `--trusted-proxy`; if it is absent, the server trusts forwarding headers from any peer.\n- Check whether `--votes-ip` is enabled, since vote de-duplication depends on the IP.","fix":"- Remark42 `1.16.2` adds mitigation; the sources say operators must also configure `--trusted-proxy` for their topology.","status":"open","published_at":"2026-11-05T21:18:53+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","triaged_at":"2026-11-05T21:41:17+00:00","updated_at":"2026-11-05T21:41:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T21:41:17Z","model":"claude-haiku-5-5","output":{"fix":"- Remark42 `1.16.2` adds mitigation; the sources say operators must also configure `--trusted-proxy` for their topology.","reach":"internet","title":"Remark42: forged proxy headers bypass rate limits and vote checks","impact":"low","summary":"Remark42, a self-hosted blog comment engine, trusts client-supplied True-Client-IP, X-Real-IP and X-Forwarded-For headers without checking the sender is a trusted proxy. A remote attacker can rotate those headers to dodge per-IP rate limits and vote de-duplication, mint anonymous identities, and write fake IPs into stored comments and logs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["self-hosted","remark42","blogs"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Rate limits and vote checks bypassed; fake IPs stored in comments and logs","analyst_note":"","how_to_check":"- Check the Remark42 version in use: `remark42 --version` or the image tag; versions from `1.0.0` through `1.16.2` are affected.\n- Check whether the deployment sets `--trusted-proxy`; if it is absent, the server trusts forwarding headers from any peer.\n- Check whether `--votes-ip` is enabled, since vote de-duplication depends on the IP.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.16.2-or-later","trusted-proxy-configured","no-direct-internet-exposure"],"who_is_affected":"Any Remark42 instance reachable directly from the internet, or behind a proxy that passes attacker-controlled forwarding headers through, is exposed. Deployments where a trusted reverse proxy strips and sets these headers, and only that proxy can reach the server, are less exposed once `--trusted-proxy` is configured correctly. The global concurrent-request throttle and request timeouts still limit availability impact.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000808,"input_tokens":4500,"output_tokens":715,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-77463':13A,16A '1.0.0':109C '1.16.2':111C,223C 'add':106C 'anonym':77B,192C 'articl':98C 'attack':59B,159C,164C 'attacker-control':158C 'avail':215C,220C 'blog':17B,28B,97C 'bucket':174C 'bypass':5A,180C 'check':10A,50B 'client':33B,37B,117C 'client-suppli':32B 'comment':29B,85B,94C,107C,197C 'concurr':205C 'concurrent-request':204C 'configur':227C 'control':146C,160C 'cve':11A,14A 'de':74B,183C 'de-dupl':73B,182C 'deploy':152C,233C 'direct':132C,150C 'dodg':65B 'duplic':75B,184C 'enabl':190C 'endpoint':179C 'engin':30B,95C 'fake':81B 'forg':2A 'forward':46B,126C,157C,168C 'fresh':172C 'global':113C,203C 'header':4A,48B,63B,161C,169C 'host':22B,27B,93C 'ident':78B,193C 'impact':216C 'ip':38B,42B,68B,82B,118C,122C,145C,188C,198C 'limit':7A,70B,178C,214C 'log':87B,201C 'middleware.realip':139C 'mint':76B,191C 'mitig':217C 'must':226C 'obtain':171C 'oper':225C 'overwrit':140C 'packag':18B 'peer':133C 'per':67B,144C,210C 'per-ip':66B,143C 'per-request':209C 'place':102C 'poison':195C 'proxi':3A,56B,137C,155C,230C 'r.remoteaddr':141C 'rate':6A,69B,177C 'rate-limit':176C 'reachabl':151C 'reader':104C 'real':41B,121C 'remark42':1A,19B,23B,88C,112C 'remot':58B,163C 'request':200C,206C,211C 'rotat':61B,166C 'run':147C 'self':21B,26B,92C 'self-host':20B,25B,91C 'sender':52B 'spoof':167C 'still':213C 'store':84B,196C 'suppli':34B 'support':218C 'throttl':207C 'timeout':212C 'token':173C 'topolog':234C 'true':36B,116C 'true-client-ip':35B,115C 'trust':31B,55B,114C,136C,229C 'trusted-proxi':228C 'verifi':129C 'version':222C 'vote':9A,72B,181C,187C 'votes-ip':186C 'without':49B,128C 'write':80B 'x':40B,45B,120C,125C 'x-forwarded-for':44B,124C 'x-real-ip':39B,119C","nicknames":[],"mitigations":[],"who_affected":"Any Remark42 instance reachable directly from the internet, or behind a proxy that passes attacker-controlled forwarding headers through, is exposed. Deployments where a trusted reverse proxy strips and sets these headers, and only that proxy can reach the server, are less exposed once `--trusted-proxy` is configured correctly. The global concurrent-request throttle and request timeouts still limit availability impact.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["blogs","medium","package","remark42","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-13T21:35:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77463","severity":null,"published_at":"2026-11-05T21:18:53+00:00","modified_at":"2026-11-05T21:18:53+00:00","first_seen_at":"2026-11-05T21:40:45+00:00","fetched_at":"2026-11-05T21:40:45+00:00","note":null}],"documents":[{"id":80384,"url":"https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80385,"url":"https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":80386,"url":"https://github.com/umputun/remark42/releases/tag/backend/v1.16.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":80387,"url":"https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-13T21:35:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}