{"id":"CVE-2026-86041","kind":"vulnerability","aliases":["CVE-2026-86041"],"related":[],"title":"ezBookkeeping: spoofed X-Forwarded-For bypasses remote IP allowlists for API tokens","description":"ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.","summary":"ezBookkeeping, a self-hosted personal finance app, trusts a client-supplied X-Forwarded-For header when checking remote IP allowlists for MCP and API tokens. An unauthenticated attacker can spoof an allowlisted address to get past those IP gates, and their activity is logged under the trusted host instead of their own address.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ezbookkeeping","gin","go","package","self-hosted"],"not_affected_if":["no-api-token-enabled","no-ip-allowlist-configured","version-1.6.0-or-later"],"how_to_check":"- Check the installed ezBookkeeping version; versions from 0.10.0 up to but not including 1.6.0 are affected.\n- Look for `mcp_allowed_remote_ips` or `api_token_allowed_remote_ips` in the ezBookkeeping configuration; their presence means the IP gate is in use.\n- Check whether the app sits behind a reverse proxy that sets X-Forwarded-For.","fix":"- ezBookkeeping: `1.6.0`","status":"open","published_at":"2026-11-04T23:17:58+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","triaged_at":"2026-11-05T00:32:00+00:00","updated_at":"2026-11-05T00:32:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T00:32:00Z","model":"claude-haiku-5-5","output":{"fix":"- ezBookkeeping: `1.6.0`","reach":"internet","title":"ezBookkeeping: spoofed X-Forwarded-For bypasses remote IP allowlists for API tokens","impact":"low","summary":"ezBookkeeping, a self-hosted personal finance app, trusts a client-supplied X-Forwarded-For header when checking remote IP allowlists for MCP and API tokens. An unauthenticated attacker can spoof an allowlisted address to get past those IP gates, and their activity is logged under the trusted host instead of their own address.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ezbookkeeping","self-hosted","go","gin"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"IP allowlist bypassed; activity misattributed in transaction and request logs","analyst_note":"","how_to_check":"- Check the installed ezBookkeeping version; versions from 0.10.0 up to but not including 1.6.0 are affected.\n- Look for `mcp_allowed_remote_ips` or `api_token_allowed_remote_ips` in the ezBookkeeping configuration; their presence means the IP gate is in use.\n- Check whether the app sits behind a reverse proxy that sets X-Forwarded-For.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.6.0-or-later","no-ip-allowlist-configured","no-api-token-enabled"],"who_is_affected":"Self-hosted ezBookkeeping instances from 0.10.0 up to 1.6.0 that rely on the mcp_allowed_remote_ips or api_token_allowed_remote_ips settings to restrict access. A valid MCP or API token is still required for protected actions, so the risk is a bypassed IP gate and misattributed audit records rather than unauthenticated data access. Instances without those allowlist settings are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000796,"input_tokens":4402,"output_tokens":711,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-86041':16A,19A '0.10.0':95C '1.6.0':97C,185C 'action':152C,155C 'activ':71B,170C 'address':62B,82B,127C 'allow':132C,138C 'allowlist':10A,49B,61B,126C 'api':12A,53B,136C,146C 'app':34B 'applic':93C 'attack':57B,122C,178C 'attribut':169C 'bypass':7A,129C 'c.clientip':109C 'caus':108C 'check':46B 'client':38B 'client-suppli':37B 'configur':106C 'construct':99C 'cve':14A,17A 'ezbookkeep':1A,20B,27B,83C,98C 'financ':33B,92C 'fix':182C 'forward':5A,42B,116C 'gate':68B,141C 'get':64B 'gin':21B,101C 'gin.new':104C 'go':22B 'header':44B 'host':26B,31B,77B,90C,174C 'instead':78B,175C 'ip':9A,48B,67B,134C,140C 'issu':180C 'log':73B,168C 'mcp':51B,131C,144C 'occur':156C 'open':86C 'packag':23B 'past':65B 'person':32B,91C 'protect':151C 'remain':148C 'remot':8A,47B,121C,133C,139C 'request':167C 'requir':149C 'router':102C 'self':25B,30B,89C 'self-host':24B,29B,88C 'settrustedproxi':107C 'sourc':87C 'spoof':2A,59B,113C,159C 'store':162C 'suppli':39B,124C 'token':13A,54B,137C,147C 'transaction.createdip':164C 'trust':35B,76B,111C,173C 'unauthent':56B,120C 'valid':143C 'valu':118C,160C 'version':184C 'without':105C 'x':4A,41B,115C 'x-forwarded-for':3A,40B,114C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted ezBookkeeping instances from 0.10.0 up to 1.6.0 that rely on the mcp_allowed_remote_ips or api_token_allowed_remote_ips settings to restrict access. A valid MCP or API token is still required for protected actions, so the risk is a bypassed IP gate and misattributed audit records rather than unauthenticated data access. Instances without those allowlist settings are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ezbookkeeping","gin","go","medium","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-19T17:30:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86041","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86041","severity":null,"published_at":"2026-11-04T23:17:58+00:00","modified_at":"2026-11-04T23:17:58+00:00","first_seen_at":"2026-11-05T00:31:00+00:00","fetched_at":"2026-11-05T00:31:00+00:00","note":null}],"documents":[{"id":71501,"url":"https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71502,"url":"https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71503,"url":"https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-19T17:30:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}