CVE-2026-105299: Vulnerability in Cloudflare https://github.com/cloudflare/pingora

Before pingora version 0.9.0, the HTTP/1 upstream request path did not remove the client's Connection header or the headers nominated by it, violating RFC 9110 Section 7.6.1. This allowed an attacker to nominate headers that Pingora adds upstream (e.g., X-Forwarded-For) to be stripped by a downstream HTTP/1 intermediary that honors Connection nominations. This affects chained deployments where an HTTP/1 intermediary between Pingora and the origin processes Connection nominations and the origin trusts headers added by that intermediary for authorization. The vulnerability enables a remote unauthenticated attacker to bypass IP-based authorization by having critical headers removed before reaching the origin. Cloudflare's own CDN customers are not affected due to internal sanitization. The vulnerability is similar to CVE-2022-31813 in Apache HTTP Server. The issue is resolved in pingora 0.9.0 by removing hop-by-hop and Connection-nominated headers from upstream requests and rejecting requests with Connection headers nominating sensitive headers.

A remote unauthenticated attacker can exploit this vulnerability in chained deployments using pingora versions before 0.9.0 to remove headers such as X-Forwarded-For that are used by the origin for IP-based authorization. This can lead to unauthorized access to IP-restricted endpoints. The vulnerability does not affect Cloudflare CDN customers. There are no known exploits in the wild at this time. The CVSS v3.1 score is 8.7 (high severity), reflecting network attack vector, high impact on confidentiality and integrity, and no privileges or user interaction required.

Upgrade to pingora version 0.9.0 or later, which removes hop-by-hop and Connection-nominated headers from upstream requests by default and rejects requests with Connection headers nominating sensitive headers. Avoid using HttpUpstreamRequestPolicy::preserve() if the origin relies on headers added by Pingora, as it restores the vulnerable behavior. If upgrading is not possible, manually remove the Connection header and all headers it nominates in the upstream_request_filter before adding trusted headers. Cloudflare manages remediation for its cloud services, but for self-hosted pingora deployments, apply the upgrade or mitigations as described.