CVE-2026-110726: Api-gateway vulnerability
In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running api-gateway through version 1.7.3 are affected on every route that uses the shipped default ClientIpKeyResolver rate-limit configuration.
What does an attacker need to bypass the rate limit?
An attacker only needs to send requests with different leftmost X-Forwarded-For header values. Because that value is client-controlled and not checked against a trusted-proxy list, each unique value produces a separate rate-limit bucket.
Are default settings affected?
Yes. The issue is in the shipped default rate-limit key resolver, ClientIpKeyResolver, so routes using the default configuration are affected.