Security update for cloudflared

The advisory covers a bug fix and enhancement update for Red Hat Hardened Images RPMs, including the cosign package version 3.1.3-0.1.hum1 for aarch64 and x86_64. It addresses three CVEs, notably CVE-2026-72816, an IP spoofing vulnerability in the go-chi/chi RealIP middleware. This vulnerability arises because the middleware parses untrusted HTTP headers (True-Client-IP, X-Real-IP, X-Forwarded-For) and overwrites the remote address without validating the upstream proxy, enabling remote attackers to bypass IP-based access controls, evade rate limiting, and poison audit logs. The impact is rated low for confidentiality and integrity. Red Hat advises against using the RealIP middleware directly with untrusted traffic and recommends sanitizing forwarding headers at an upstream proxy. The advisory does not provide explicit CVSS scores but classifies the overall severity as medium. The update is available and should be applied to affected systems.

The vulnerabilities allow remote attackers to spoof IP addresses by injecting arbitrary values into client-controlled HTTP headers, potentially bypassing IP-based access controls, evading rate limiting, and polluting audit logs. The confidentiality and integrity impact is low, and availability is not affected. No known exploits in the wild have been reported. The issues affect the cosign package within Red Hat Hardened Images RPMs, which could lead to unauthorized access or evasion of security controls if unmitigated.

Red Hat has released an update to the Red Hat Hardened Images RPMs including cosign version 3.1.3-0.1.hum1 that addresses these vulnerabilities. Users should apply this update promptly. Additionally, Red Hat advises not to use the vulnerable go-chi/chi RealIP middleware when receiving traffic directly from untrusted networks or unverified proxies. Instead, client-supplied forwarding headers should be stripped or sanitized at an upstream edge or reverse proxy such as NGINX or HAProxy before requests reach the application. This reduces the risk of IP spoofing attacks. Patch status is confirmed by the vendor advisory, so applying the update is the recommended remediation.