CVE-2026-80349: Authentication Bypass by Spoofing in TarsCloud TarsWeb

TarsWeb uses the Koa framework with proxy mode enabled but does not restrict trusted upstream proxies or limit forwarded hops, causing the effective client IP to be taken from the X-Forwarded-For header supplied by the client. The authentication middleware combines the ignored-path list and an allowlist of IPs (including the loopback address) in a single branch that assigns the user identity from the uid query parameter without validating any authentication tokens. An attacker can forge the X-Forwarded-For header to appear as the loopback address and specify any uid, thereby gaining full access to all routes mounted by the console, including administrative functions such as user and role management, service configuration, and package deployment. The fix in version 3.0.16 separates the allowlist logic to assign a default account rather than trusting the uid parameter when the request originates from a trusted IP.

An attacker can bypass authentication entirely by spoofing the X-Forwarded-For header to the loopback address and specifying a uid of an existing account. This grants unauthorized access to all administrative and sensitive functions in TarsWeb, including user and role administration, service configuration, and package deployment. The vulnerability allows full control over the affected system without any credentials, representing a critical security risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Version 3.0.16 reportedly fixes the issue by changing the authentication logic to prevent assigning user identity based on client-supplied uid when the request appears from a trusted IP. Until an official patch is confirmed, avoid exposing TarsWeb to untrusted networks or untrusted clients that can manipulate headers. Monitor vendor channels for an official fix or update.