CVE-2026-110724: Api-gateway vulnerability
In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments of api-gateway through version 1.7.3 are affected on every route using the shipped default ClientIpKeyResolver configuration.
What does an attacker need to bypass rate limiting?
An attacker only needs to send requests with different leftmost X-Forwarded-For header values. Because that value is client-controlled and not checked against a trusted-proxy list, each unique value receives a separate rate-limit bucket.
Does this require a trusted proxy or a special network position?
No. The vulnerable resolver uses the originating client's supplied leftmost X-Forwarded-For value, so a client can directly influence the rate-limit key.