---
id: "CVE-2026-86041"
kind: "vulnerability"
aliases: ["CVE-2026-86041"]
title: "ezBookkeeping: spoofed X-Forwarded-For bypasses remote IP allowlists for API tokens"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ezbookkeeping", "gin", "go", "package", "self-hosted"]
not_affected_if: ["no-api-token-enabled", "no-ip-allowlist-configured", "version-1.6.0-or-later"]
published_at: "2026-11-04T23:17:58+00:00"
first_seen_at: "2026-11-05T00:31:00+00:00"
updated_at: "2026-11-05T00:32:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86041", "first_seen_at": "2026-11-05T00:31:00+00:00"}]
exploit_sources: []
---

# ezBookkeeping: spoofed X-Forwarded-For bypasses remote IP allowlists for API tokens

ezBookkeeping, a self-hosted personal finance app, trusts a client-supplied X-Forwarded-For header when checking remote IP allowlists for MCP and API tokens. An unauthenticated attacker can spoof an allowlisted address to get past those IP gates, and their activity is logged under the trusted host instead of their own address.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ezBookkeeping version; versions from 0.10.0 up to but not including 1.6.0 are affected.
- Look for `mcp_allowed_remote_ips` or `api_token_allowed_remote_ips` in the ezBookkeeping configuration; their presence means the IP gate is in use.
- Check whether the app sits behind a reverse proxy that sets X-Forwarded-For.

## Fix

- ezBookkeeping: `1.6.0`

## Timeline

- 2026-11-05T00:31:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86041

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q
- [fix] Patch: github.com https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986
- [fix] Release notes: github.com https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0

## From the sources

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_