CVE-2026-62987Medium· 5.8▾ TwilightPoC availableFabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 31.9 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 23.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.2%
Last analysed / modified upstream
0.2% → 0.2%
Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/fabiolb/fabio >= 1.6.6, <= 1.7.1Patched in:
github.com/fabiolb/fabio 1.7.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61682Critical· 9.9kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads
CVE-2026-72816Medium· 6.5go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go)
CVE-2026-72815Medium· 6.9go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header
CVE-2022-51026Medium· 9.8Bytebase vulnerable to Improper Authentication
CVE-2026-114612Critical· 9.9LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
CVE-2026-62367High· 7.5Vikunja is an open-source self-hosted task management platform