CVE-2026-119711 PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header

Medium 6.9 Published 30 Oct 2026 Updated 4 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-119711?

CVE-2026-119711 is a medium-severity vulnerability in pipeshub-ai, published on 30 Oct 2026.

Official description

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.

Weakness: CWE-348

Which versions are affected by CVE-2026-119711?

How do I fix CVE-2026-119711?

No fix has been published for CVE-2026-119711 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119711 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-119711 exists.

Sources

Also known as GHSA-78gw-g2h7-xvjj, GHSA-v4v4-55gm-p3cp.