CVE-2026-108736: Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Q: Which deployments are exposed?

Speedtest Tracker deployments through 1.15.0 are affected when access to web or API endpoints is restricted with ALLOWED_IPS, or when Prometheus metrics are protected by an allowlist. An attacker must be able to reach the application over the network.

Q: What does an attacker need to exploit the bypass?

No authentication or user interaction is required. The attacker can send an X-Forwarded-For header containing an allowlisted IP address because the application trusts every peer as a proxy.

Q: What can an attacker access after bypassing the allowlist?

An attacker can read the /prometheus metrics endpoint and access web and API endpoints that rely on the affected IP allowlist checks.

Q: How can I determine whether my instance is affected?

Check whether the deployment is Speedtest Tracker 1.15.0 or earlier and uses ALLOWED_IPS or a Prometheus allowlist. Also verify whether the application accepts a client-supplied X-Forwarded-For value as the client IP, rather than limiting trusted proxy sources.

Published Oct 11, 2026

Updated

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.

Affected Software

1 affected component

Speedtest Tracker Speedtest Tracker<=1.15.0

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Speedtest Tracker deployments through 1.15.0 are affected when access to web or API endpoints is restricted with ALLOWED_IPS, or when Prometheus metrics are protected by an allowlist. An attacker must be able to reach the application over the network.

What does an attacker need to exploit the bypass?

No authentication or user interaction is required. The attacker can send an X-Forwarded-For header containing an allowlisted IP address because the application trusts every peer as a proxy.

What can an attacker access after bypassing the allowlist?

An attacker can read the /prometheus metrics endpoint and access web and API endpoints that rely on the affected IP allowlist checks.

How can I determine whether my instance is affected?

Check whether the deployment is Speedtest Tracker 1.15.0 or earlier and uses ALLOWED_IPS or a Prometheus allowlist. Also verify whether the application accepts a client-supplied X-Forwarded-For value as the client IP, rather than limiting trusted proxy sources.

CVE-2026-108736: Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit the bypass?

What can an attacker access after bypassing the allowlist?

How can I determine whether my instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit the bypass?

What can an attacker access after bypassing the allowlist?

How can I determine whether my instance is affected?