Medium, CVSS 5.3GoAmendedPublished
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed X-Forwarded-For header
CVE-2026-86041 · GHSA-wchh-mrv2-5h4q
- Affected
- Go github.com/mayswind/ezbookkeeping >= 0.10.0, < 1.6.0
- Fixed in
- 1.6.0· Vendor fix available
- Issue
- A remote attacker from any IP address defeats the operator-configured source-IP allowlist (`mcp_allowed_remote_ips` / `api_token_allowed_remote_ips`) by sending a single `X-Forwarded-For: ` header. The router is created with `gin.New()` and never calls `SetTrustedProxies`, so gin trusts every proxy by default and `c.ClientIP()` returns the attacker-supplied header verbatim. The same forged value is also written to `Transaction.CreatedIp` and the access log, so the attacker's real IP never appears in any record. Details `cmd/webserver.go:104` builds the router with `gin.New()`. A grep of `cmd/` and `pkg/` confirms `SetTrustedProxies` is never called, leaving gin's default trusted-proxy range of `0.0.0.0/0` and `::/0`. `WebContext` (`pkg/core/context_web.go:39`) embeds `*gin.Context` and does not override `ClientIP()`. Both allowlist middlewares match the operator allowlist against this attacker-controlled value: ```go // pkg/middlewares/mcp_server_ip_limit.go:19 if…
Recommended action: Upgrade to 1.6.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.