CVE-2026-77463

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77463", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T20:07:49.962Z", "datePublished": "2026-11-05T20:54:09.798Z", "dateUpdated": "2026-11-10T04:20:00.888Z"}, "containers": {"cna": {"title": "Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment", "problemTypes": [{"descriptions": [{"cweId": "CWE-348", "lang": "en", "description": "CWE-348: Use of Less Trusted Source", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-807", "lang": "en", "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27"}, {"name": "https://github.com/umputun/remark42/pull/2116", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/pull/2116"}, {"name": "https://github.com/umputun/remark42/pull/2118", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/pull/2118"}, {"name": "https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39"}, {"name": "https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab"}, {"name": "https://github.com/umputun/remark42/releases/tag/backend/v1.16.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/releases/tag/backend/v1.16.2"}, {"name": "https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip", "tags": ["x_refsource_MISC"], "url": "https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip"}], "affected": [{"vendor": "umputun", "product": "remark42", "versions": [{"version": ">= 1.0.0, < 1.16.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:54:09.798Z"}, "descriptions": [{"lang": "en", "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology."}], "source": {"advisory": "GHSA-56x6-q882-mf27", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T04:19:02.667896Z", "id": "CVE-2026-77463", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:20:00.888Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77463", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-20T20:07:49.962Z", "datePublished": "2026-11-05T20:54:09.798Z", "dateUpdated": "2026-11-10T04:20:00.888Z"}, "containers": {"cna": {"title": "Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment", "problemTypes": [{"descriptions": [{"cweId": "CWE-348", "lang": "en", "description": "CWE-348: Use of Less Trusted Source", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-807", "lang": "en", "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27"}, {"name": "https://github.com/umputun/remark42/pull/2116", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/pull/2116"}, {"name": "https://github.com/umputun/remark42/pull/2118", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/pull/2118"}, {"name": "https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39"}, {"name": "https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab"}, {"name": "https://github.com/umputun/remark42/releases/tag/backend/v1.16.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/umputun/remark42/releases/tag/backend/v1.16.2"}, {"name": "https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip", "tags": ["x_refsource_MISC"], "url": "https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip"}], "affected": [{"vendor": "umputun", "product": "remark42", "versions": [{"version": ">= 1.0.0, < 1.16.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:54:09.798Z"}, "descriptions": [{"lang": "en", "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology."}], "source": {"advisory": "GHSA-56x6-q882-mf27", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-77463", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T04:19:02.667896Z"}}}], "references": [{"url": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:19:23.107Z"}}]}}

{"affected": [{"affectedData": [{"product": "remark42", "vendor": "umputun", "versions": [{"status": "affected", "version": ">= 1.0.0, < 1.16.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the direct peer is a trusted proxy, and middleware.RealIP overwrites r.RemoteAddr before per-IP controls run. In a directly reachable deployment, or a proxy that forwards attacker-controlled headers, a remote attacker can rotate spoofed forwarding headers to obtain fresh token buckets for rate-limited endpoints, bypass vote de-duplication when --votes-ip is enabled, mint anonymous identities, and poison stored comment IPs and request logs. The global concurrent-request throttle and per-request timeouts still limit availability impact. Mitigation support is available in version 1.16.2, but operators must configure --trusted-proxy for the deployment topology."}], "id": "CVE-2026-77463", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77463", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T04:19:02.667896Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:53.727", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39"}, {"source": "security-advisories@github.com", "url": "https://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab"}, {"source": "security-advisories@github.com", "url": "https://github.com/umputun/remark42/pull/2116"}, {"source": "security-advisories@github.com", "url": "https://github.com/umputun/remark42/pull/2118"}, {"source": "security-advisories@github.com", "url": "https://github.com/umputun/remark42/releases/tag/backend/v1.16.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27"}, {"source": "security-advisories@github.com", "url": "https://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-348"}, {"lang": "en", "value": "CWE-807"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/umputun/remark42: Remark42: Security control bypass via spoofed IP headers", "id": "2567759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567759"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-348", "details": ["A flaw was found in Remark42. The application trusts client-supplied HTTP forwarding headers to determine the client's IP address without verifying that requests originate from a trusted proxy. A remote attacker can exploit this vulnerability by sending spoofed IP headers, allowing them to bypass IP-based rate limiting, circumvent voting restrictions, forge identities, and corrupt audit logs."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-77463", "public_date": "2026-11-05T20:54:09Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-77463\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-77463\nhttps://github.com/umputun/remark42/commit/b1502801facd7782a1c70fd51f8ad5c2eb650d39\nhttps://github.com/umputun/remark42/commit/e62b3c830d81659cf5d2687b0c8261da7d42fdab\nhttps://github.com/umputun/remark42/pull/2116\nhttps://github.com/umputun/remark42/pull/2118\nhttps://github.com/umputun/remark42/releases/tag/backend/v1.16.2\nhttps://github.com/umputun/remark42/security/advisories/GHSA-56x6-q882-mf27\nhttps://remark42.com/docs/configuration/parameters/#trusted-proxies-and-client-ip"], "statement": "This vulnerability is rated as Moderate impact because an unauthenticated remote attacker can evade IP-based request throttling and voting restrictions without gaining broader system privileges or accessing confidential data. While overall service availability remains protected by global request concurrency limits, the issue degrades IP validation and audit trail accuracy. Remark42 is not distributed or supported in any Red Hat product lines.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.16.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "remark42", "source": "cna", "vendor": "umputun"}, "product": "remark42", "vendor": "umputun"}], "created": "2026-11-05T22:30:17.932333+00:00", "updated": "2026-11-05T22:45:09.645852+00:00", "vendors": ["umputun", "umputun$PRODUCT$remark42"]}