CVE-2026-110723: Api-gateway vulnerability
In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments of api-gateway through version 1.7.3 are affected on every route that uses the shipped default ClientIpKeyResolver configuration for rate limiting.
What does an attacker need to bypass the limit?
An attacker only needs to control the X-Forwarded-For request header. By sending different leftmost header values, the attacker can obtain separate rate-limit buckets.
Are default settings affected?
Yes. The issue is in the shipped default rate-limit key resolver, which trusts the client-supplied leftmost X-Forwarded-For value without validating it against a trusted-proxy list.