CVE-2026-110726: CWE-348 in Eclipse Foundation Eclipse Connected Services Platform

In Eclipse Connected Services Platform api-gateway versions >=1.5.4 and <=1.7.3, the default ClientIpKeyResolver derives the per-client rate-limit key from the first element of the X-Forwarded-For HTTP header. Since this header element is controlled by the originating client and is not validated against any trusted proxy list, an attacker can supply arbitrary values to create multiple independent rate-limit buckets. This flaw enables complete bypass of request-rate limiting on routes using the default configuration.

An attacker can circumvent the gateway's rate limiting by manipulating the X-Forwarded-For header, allowing them to send an unlimited number of requests without restriction. This can lead to denial of service or resource exhaustion on the affected services relying on the api-gateway for rate limiting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing custom rate-limit key resolvers that validate the X-Forwarded-For header against a trusted proxy list or use alternative client identification methods to prevent bypass.