CVE-2026-126400: Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex
Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the recorded request IP via unanchored trusted-proxy regular expressions. Clients in 110.0.0.0/8 or 210.0.0.0/8, or connecting directly, can supply X-Forwarded-For values to falsify audit log entries and shift password generator rate limits.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to spoofed client IP addresses?
Password Pusher versions from 1.49.0 before 2.17.0 are affected. Remote clients from 110.0.0.0/8 or 210.0.0.0/8, as well as clients connecting directly, can exploit the trusted-proxy matching issue.
What does an attacker need to exploit this issue?
The attacker does not need credentials or user interaction, but exploitation has high attack complexity. They must be able to send requests with crafted X-Forwarded-For values from an applicable source network or through a direct connection.
What is the practical impact of successful exploitation?
An attacker can falsify the request IP recorded in audit logs. They can also shift password-generator rate limits by making requests appear to originate from another IP address.