PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Pipeshub
  • Pipeshub

No data.

No data.

References
Link Providers
https://github.com/pipeshub-ai/pipeshub-ai cve-icon cve-icon
https://github.com/pipeshub-ai/pipeshub-ai/blob/v0.9.1/backend/nodejs/apps/src/libs/middlewares/rate-limit.middleware.ts cve-icon cve-icon
https://github.com/pipeshub-ai/pipeshub-ai/commit/84614464bb120e9f8e8c85420001260e709d99bb cve-icon cve-icon
https://github.com/pipeshub-ai/pipeshub-ai/releases/tag/v0.10.0 cve-icon cve-icon
https://github.com/pipeshub-ai/pipeshub-ai/security/advisories/GHSA-78gw-g2h7-xvjj cve-icon cve-icon cve-icon
https://www.vulncheck.com/advisories/pipeshub-before-0.10.0-rate-limit-bypass-via-spoofed-x-forwarded-for-header cve-icon cve-icon
History

Wed, 04 Nov 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.
Title PipesHub before 0.10.0 Rate Limit Bypass via Spoofed X-Forwarded-For Header
First Time appeared Pipeshub
Pipeshub pipeshub
Weaknesses CWE-348
CPEs cpe:2.3:a:pipeshub:pipeshub:*:*:*:*:*:*:*:*
Vendors & Products Pipeshub
Pipeshub pipeshub
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-10-30T15:16:10.897Z

Updated: 2026-11-04T22:54:10.739Z

Reserved: 2026-10-30T14:49:25.278Z

Link: CVE-2026-119711

cve-icon Vulnrichment

Updated: 2026-11-04T22:54:03.232Z

cve-icon NVD

Status : Deferred

Published: 2026-10-30T16:17:54.243

Modified: 2026-11-04T23:17:22.397

Link: CVE-2026-119711

cve-icon Redhat

No data.