{"vulnerability": "ghsa-pqg7-v6wh-3pfp", "sightings": [{"uuid": "fb83f64f-3cc3-452d-8eb7-0727df515e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-PQG7-V6WH-3PFP", "type": "seen", "source": "https://gist.github.com/alon710/5c21af8cb6d4ec1c461f4a0ac7b833d6", "content": "# GHSA-PQG7-V6WH-3PFP: GHSA-pqg7-v6wh-3pfp: IP Spoofing and Access Control Bypass via HTTP Header Injection in TsDProxy\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/GHSA-PQG7-V6WH-3PFP\n\n## Summary\nA high-severity input sanitization and header injection vulnerability in TsDProxy allows authenticated Tailscale users to inject arbitrary values into the X-Forwarded-For and X-Real-IP HTTP headers. Because downstream backend services frequently trust these headers to resolve client identities, attackers can exploit this flaw to bypass IP-based access control lists, audit logs, and geo-blocking restrictions.\n\n## TL;DR\nTsDProxy failed to sanitize client-provided 'X-Forwarded-For' and 'X-Real-IP' headers, enabling authenticated attackers to spoof their identity and bypass downstream IP-based administrative restrictions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.5 (High)\n- **Impact**: Security Bypass / IP Spoofing\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- TsDProxy\n- **tsdproxy**: < 3.0.0-alpha.3 (Fixed in: `3.0.0-alpha.3`)\n\n## Mitigation\n\n- Upgrade TsDProxy to safe version 3.0.0-alpha.3 or higher.\n- Configure downstream backends to ignore proxy-delivered IP headers from untrusted origins.\n- Enforce secondary authentication controls instead of relying purely on network-layer source IPs.\n\n**Remediation Steps:**\n1. Identify all active deployments of tsdproxy inside your tailnets.\n2. Update the deployment manifests or Docker files to use version 3.0.0-alpha.3 or later.\n3. If using Nginx as backend, verify real_ip settings and ensure 'real_ip_recursive' is enabled.\n\n## References\n\n- [GitHub Security Advisory GHSA-pqg7-v6wh-3pfp](https://github.com/almeidapaulopt/tsdproxy/security/advisories/GHSA-pqg7-v6wh-3pfp)\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-pqg7-v6wh-3pfp)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PQG7-V6WH-3PFP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-14T23:41:52.108196Z"}, {"uuid": "b5788a59-2015-4f47-8611-b46669f11039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-PQG7-V6WH-3PFP", "type": "seen", "source": "https://gist.github.com/alon710/5c21af8cb6d4ec1c461f4a0ac7b833d6", "content": "# GHSA-PQG7-V6WH-3PFP: GHSA-pqg7-v6wh-3pfp: IP Spoofing and Access Control Bypass via HTTP Header Injection in TsDProxy\n\n> **CVSS Score:** 8.5\n> **Published:** 2026-07-14\n> **Full Report:** https://cvereports.com/reports/GHSA-PQG7-V6WH-3PFP\n\n## Summary\nA high-severity input sanitization and header injection vulnerability in TsDProxy allows authenticated Tailscale users to inject arbitrary values into the X-Forwarded-For and X-Real-IP HTTP headers. Because downstream backend services frequently trust these headers to resolve client identities, attackers can exploit this flaw to bypass IP-based access control lists, audit logs, and geo-blocking restrictions.\n\n## TL;DR\nTsDProxy failed to sanitize client-provided 'X-Forwarded-For' and 'X-Real-IP' headers, enabling authenticated attackers to spoof their identity and bypass downstream IP-based administrative restrictions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-74\n- **Attack Vector**: Network\n- **CVSS v3.1**: 8.5 (High)\n- **Impact**: Security Bypass / IP Spoofing\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- TsDProxy\n- **tsdproxy**: < 3.0.0-alpha.3 (Fixed in: `3.0.0-alpha.3`)\n\n## Mitigation\n\n- Upgrade TsDProxy to safe version 3.0.0-alpha.3 or higher.\n- Configure downstream backends to ignore proxy-delivered IP headers from untrusted origins.\n- Enforce secondary authentication controls instead of relying purely on network-layer source IPs.\n\n**Remediation Steps:**\n1. Identify all active deployments of tsdproxy inside your tailnets.\n2. Update the deployment manifests or Docker files to use version 3.0.0-alpha.3 or later.\n3. If using Nginx as backend, verify real_ip settings and ensure 'real_ip_recursive' is enabled.\n\n## References\n\n- [GitHub Security Advisory GHSA-pqg7-v6wh-3pfp](https://github.com/almeidapaulopt/tsdproxy/security/advisories/GHSA-pqg7-v6wh-3pfp)\n- [GitHub Advisory Database Entry](https://github.com/advisories/GHSA-pqg7-v6wh-3pfp)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-PQG7-V6WH-3PFP) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-15T00:00:00.573313Z"}]}