CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.

• CWE-348

• https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986
• https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0
• https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q
• https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q

Published

Nov 4, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8603In ScadaBR version 1.2.0, an OS Command Injection vulnerabil…9.8
• CVE-2026-86035Weblate is a web-based continuous localization platform used…8.5
• CVE-2026-86038libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86039libp2p is a JavaScript implementation of the libp2p networki…8.2
• CVE-2026-8604In ScadaBR version 1.2.0, a CSRF vulnerability could allow a…8.8
• CVE-2026-86040libp2p is a JavaScript implementation of the libp2p networki…7.5
• CVE-2026-86043Skipper is an HTTP router and reverse proxy for service comp…7.5
• CVE-2026-86047MariaDB server is a community developed fork of MySQL server…7.7
• CVE-2026-86049Jupyter Server is the backend for Jupyter web applications. …7.1
• CVE-2026-8605In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vu…9.8
• CVE-2026-86054Notepad++ is a free and open-source source code editor. Prio…7.8
• CVE-2026-86055Part-DB is an open source inventory management system for el…8.7