CVE-2026-108736: Use of Less Trusted Source in alexjustesen speedtest-tracker
Description
Speedtest Tracker versions up to 1.15.0 have an IP allowlist bypass vulnerability. This flaw allows unauthenticated remote attackers to spoof X-Forwarded-For headers to evade IP-based access controls and Prometheus allowlists. The vulnerability arises because the application trusts every peer as a proxy, enabling attackers to access protected metrics and web/API endpoints by supplying an allowlisted IP address via headers.
CVSS v4.0
Score 6.3medium
Affected software
alexjustesen
speedtest-tracker
pkg:github/speedtest-trackerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-108736 describes an IP allowlist bypass vulnerability in alexjustesen's Speedtest Tracker up to version 1.15.0. The vulnerability is due to the application's bootstrap/app.php trusting all peers as proxies, which allows attackers to spoof the X-Forwarded-For HTTP header. By doing so, attackers can bypass ALLOWED_IPS and Prometheus allowlists, gaining unauthorized access to protected /prometheus metrics and web/API endpoints without authentication.
Potential Impact
Unauthenticated remote attackers can bypass IP-based access controls and Prometheus allowlists, potentially exposing sensitive metrics and protected web and API endpoints. This could lead to information disclosure or unauthorized access to internal monitoring data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict or validate trusted proxy sources carefully and do not blindly trust X-Forwarded-For headers from untrusted peers.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-11T01:52:49.073Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acb85c22cdf04f656d09a25
Added to database: 10/11/2026, 12:49:06 UTC
Last enriched: 10/11/2026, 13:04:07 UTC
Last updated: 10/11/2026, 21:33:16 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.