CVE-2026-57942 LibreTranslate - IP Spoofing via X-Forwarded-For Header
Attackers can bypass IP-based rate limits and bans by spoofing X-Forwarded-For headers, enabling unlimited API abuse and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57942?
CVE-2026-57942 is a medium-severity vulnerability in LibreTranslate, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get_remote_address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.
Weakness: CWE-348
Which versions are affected by CVE-2026-57942?
How do I fix CVE-2026-57942?
No fix has been published for CVE-2026-57942 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-57942 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57942 exists.
Sources
Also known as GHSA-4rjg-9qq9-25m8.