CVE-2026-119711: falha de média gravidade em pipeshub-ai
PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.9epss 0.2%
PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
pipeshub-ai · pipeshub-aiCVEs relacionadas — pipeshub-ai
No mesmo produto, das mais perigosas para as menos.
CVE-2025-67506CRITICALPipesHub Vulnerable to Path Traversal through Unauthenticated Arbitrary File UploadEPSS 1.8%CVE-2026-119710HIGHPipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule RouteEPSS 0.4%CVE-2026-119712MEDIUMPipesHub before 0.10.0 SSRF via Image URLs in Indexed DocumentsEPSS 0.3%
Referências
https://github.com/pipeshub-ai/pipeshub-aihttps://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/libs/middlewares/rate-limit.middleware.tshttps://github.com/pipeshub-ai/pipeshub-ai/commit/84614464bb120e9f8e8c85420001260e709d99bbhttps://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-78gw-g2h7-xvjjhttps://www.vulncheck.com/advisories/pipeshub-before-0.10.0-rate-limit-bypass-via-spoofed-x-forwarded-for-header