CVE-2026-27981

HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a TrustProxy option in the configuration (Options.TrustProxy, default false), but this option was never read by any middleware or rate limiter code. Additionally, chi's middleware.RealIP was applied unconditionally in main.go, overwriting r.RemoteAddr with the forged header value before it reaches any handler. This vulnerability is fixed in 0.24.0.

• CWE-307

• https://github.com/sysadminsmedia/homebox/security/advisories/GHSA-j86g-v96v-jpp3Vendor Advisory

Published

Mar 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27976Zed, a code editor, has an extension installer allows tar/gz…8.8
• CVE-2026-27977Next.js is a React framework for building full-stack web app…5.4
• CVE-2026-27978Next.js is a React framework for building full-stack web app…4.3
• CVE-2026-27979Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-2798Use-after-free in the DOM: Core & HTML component. This vulne…8.8
• CVE-2026-27980Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-27982An open redirect vulnerability exists in django-allauth vers…6.1
• CVE-2026-27983Incorrect Privilege Assignment vulnerability in designthemes…9.8
• CVE-2026-27984Improper Control of Generation of Code ('Code Injection') vu…9
• CVE-2026-27985Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2026-27986Improper Control of Filename for Include/Require Statement i…8.1
• CVE-2026-27987Improper Control of Filename for Include/Require Statement i…8.1