CVE-2026-119711: medium-severity vulnerability in pipeshub-ai
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.2%
PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
pipeshub-ai · pipeshub-aiRelated CVEs — pipeshub-ai
In the same product, most dangerous first.
CVE-2025-67506CRITICALPipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File UploadEPSS 1.8%CVE-2026-119710HIGHPipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule RouteEPSS 0.4%CVE-2026-119712MEDIUMPipesHub before 0.10.0 SSRF via Image URLs in Indexed DocumentsEPSS 0.3%
References
https://github.com/pipeshub-ai/pipeshub-aihttps://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/libs/middlewares/rate-limit.middleware.tshttps://github.com/pipeshub-ai/pipeshub-ai/commit/84614464bb120e9f8e8c85420001260e709d99bbhttps://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-78gw-g2h7-xvjjhttps://www.vulncheck.com/advisories/pipeshub-before-0.10.0-rate-limit-bypass-via-spoofed-x-forwarded-for-header