Security update for cloudflared

Red Hat has released an update for Hardened Images RPMs including spire1.14 packages (version 1.14.7-0.4.hum1) that fix multiple vulnerabilities such as CVE-2026-72815, CVE-2026-72816, and CVE-2026-72817. A key vulnerability (CVE-2026-72816) involves the go-chi/chi RealIP middleware, which improperly trusts unvalidated HTTP headers (True-Client-IP, X-Real-IP, X-Forwarded-For) to overwrite the remote address, enabling IP spoofing. This can allow attackers to bypass IP-restricted endpoints, evade rate limits, and poison audit logs. The vulnerability has a medium impact rating and no known exploits in the wild. The Red Hat advisory recommends not using the RealIP middleware directly with untrusted networks and instead sanitizing headers at upstream proxies. The update packages are available for aarch64 and x86_64 architectures.

The IP spoofing vulnerability in the go-chi/chi RealIP middleware allows remote unauthenticated attackers to supply arbitrary IP addresses in HTTP headers, potentially bypassing IP-based access controls, evading rate limiting and geo-IP restrictions, and polluting audit logs. This poses a low impact to confidentiality and integrity but can undermine access control mechanisms and logging accuracy. The overall severity is medium as assessed by Red Hat. There are no known exploits in the wild at this time.

Red Hat has released updated RPM packages (spire1.14 version 1.14.7-0.4.hum1) that fix the vulnerabilities described. Users should apply these updates to remediate the issues. Additionally, for the IP spoofing vulnerability in the RealIP middleware, Red Hat advises not to use this middleware when receiving traffic directly from untrusted networks or unverified proxies. Instead, client-supplied forwarding headers should be stripped or sanitized at an upstream edge proxy or reverse proxy (e.g., NGINX or HAProxy) before requests reach the application. Follow the vendor advisory instructions for applying updates and mitigation.