CVE-2026-9561 affects Eclipse Kura versions 5.0.0 through 5.6.1. The vulnerability arises because the Web Console and REST API components use the X-Forwarded-For HTTP header as the primary source for client IP addresses when initializing audit context. Additionally, Jetty's ForwardedRequestCustomizer is installed unconditionally on all HTTP/HTTPS connectors, causing HttpServletRequest.getRemoteAddr() to reflect the attacker-controlled header value. This enables unauthenticated remote attackers to spoof IP addresses in audit logs, bypassing IP-based brute-force protections such as fail2ban or causing denial of service by injecting victim IPs to trigger bans.

An attacker can bypass IP-based brute-force protections by spoofing the X-Forwarded-For header, causing audit logs to record a non-routable or attacker-chosen IP address instead of the true client IP. This allows brute-force attacks to proceed undetected. Additionally, attackers can cause denial of service against third parties by injecting their IP addresses into logs, triggering automated bans on those victim IPs.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, organizations should consider disabling or restricting the use of the X-Forwarded-For header as a trusted source for client IP addresses in audit logs, or implement additional validation to ensure the authenticity of client IP information. Monitoring and adjusting IP-based blocking tools to account for this behavior may also help mitigate risk.