CVE-2026-86041

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86041", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-04T19:29:21.058Z", "datePublished": "2026-11-04T22:15:56.477Z", "dateUpdated": "2026-11-05T19:48:52.330Z"}, "containers": {"cna": {"title": "ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header", "problemTypes": [{"descriptions": [{"cweId": "CWE-348", "lang": "en", "description": "CWE-348: Use of Less Trusted Source", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q"}, {"name": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986", "tags": ["x_refsource_MISC"], "url": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986"}, {"name": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0"}], "affected": [{"vendor": "mayswind", "product": "ezbookkeeping", "versions": [{"version": ">= 0.10.0, < 1.6.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T22:15:56.477Z"}, "descriptions": [{"lang": "en", "value": "ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0."}], "source": {"advisory": "GHSA-wchh-mrv2-5h4q", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:47:23.543425Z", "id": "CVE-2026-86041", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:48:52.330Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86041", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:47:23.543425Z"}}}], "references": [{"url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:47:41.820Z"}}], "cna": {"title": "ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header", "source": {"advisory": "GHSA-wchh-mrv2-5h4q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "mayswind", "product": "ezbookkeeping", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.6.0"}]}], "references": [{"url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q", "name": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986", "name": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0", "name": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-348", "description": "CWE-348: Use of Less Trusted Source"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-04T22:15:56.477Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86041", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:48:52.330Z", "dateReserved": "2026-09-04T19:29:21.058Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-04T22:15:56.477Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ezbookkeeping", "vendor": "mayswind", "versions": [{"status": "affected", "version": ">= 0.10.0, < 1.6.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0."}], "id": "CVE-2026-86041", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86041", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:47:23.543425Z", "version": "2.0.3"}}]}, "published": "2026-11-04T23:17:58.903", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986"}, {"source": "security-advisories@github.com", "url": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-348"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/mayswind/ezbookkeeping: ezBookkeeping: IP allowlist bypass via spoofed X-Forwarded-For header", "id": "2567680", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567680"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-348", "details": ["ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.", "A flaw was found in ezBookkeeping. Due to missing trusted proxy configurations in the web router, the application inherently trusts client-supplied network headers. A remote attacker can exploit this flaw by sending a request with a spoofed X-Forwarded-For HTTP header containing an authorized IP address. This enables the attacker to bypass IP-based access restrictions and cause subsequent actions to be falsely attributed to trusted hosts in audit and transaction logs."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-86041", "public_date": "2026-11-04T22:15:56Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86041\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86041\nhttps://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986\nhttps://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0\nhttps://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q"], "statement": "This vulnerability is rated with Moderate impact because, while the issue is remotely exploitable, forging source IP addresses alone does not grant access to restricted functionality without possessing legitimate authentication tokens. The blast radius is limited to bypassing IP filtering rules and spoofing audit attribution rather than full privilege escalation or arbitrary execution. Furthermore, ezBookkeeping is not distributed or supported within Red Hat enterprise products.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.10.0,1.6.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "ezbookkeeping", "source": "cna", "vendor": "mayswind"}, "product": "ezbookkeeping", "vendor": "mayswind"}], "created": "2026-11-04T23:45:08.236539+00:00", "updated": "2026-11-05T00:15:15.148086+00:00", "vendors": ["mayswind", "mayswind$PRODUCT$ezbookkeeping"]}