Vulnerability Bulletins |
CVE-2026-108736 |
|
| Affected software | PROMETHEUS |
| Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-108736 | |