CVE-2026-86041 — ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Exploitation evidence

Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.

KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗

Reported products and versions

mayswind / ezbookkeeping

Default status: Not specified

affected: >= 0.10.0, < 1.6.0

Fixes and workarounds

No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.

Sources and related reporting

CVE Program record ↗ · Download tracked evidence as JSON

Monitored source mentions

GitHub Advisory Database — ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header ↗

Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.

Reviewed Egret reports

Spoofed X-Forwarded-For header bypasses ezBookkeeping IP allowlist and forges audit logs

Observed change timeline

History begins when Egret first downloads each source. It is not the complete upstream CVE history.

12 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-12",
  "epss": 0.00221,
  "percentile": 0.12792
}

10 Nov 2026, 18:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-10",
  "epss": 0.00221,
  "percentile": 0.12757
}

10 Nov 2026, 12:20 Jerusalem · EPSS observation updated

Stored EPSS snapshot at this observation.

{
  "date": "2026-11-09",
  "epss": 0.00221,
  "percentile": 0.12726
}

10 Nov 2026, 12:20 Jerusalem · CVE Program record changed

Stored CNA snapshot at this observation.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86041",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T19:47:23.543425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:48:52.330Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ezbookkeeping",
          "vendor": "mayswind",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.10.0, < 1.6.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-348",
              "description": "CWE-348: Use of Less Trusted Source",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T22:15:56.477Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q"
        },
        {
          "name": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986"
        },
        {
          "name": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0"
        }
      ],
      "source": {
        "advisory": "GHSA-wchh-mrv2-5h4q",
        "discovery": "UNKNOWN"
      },
      "title": "ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-86041",
    "datePublished": "2026-11-04T22:15:56.477Z",
    "dateReserved": "2026-09-04T19:29:21.058Z",
    "dateUpdated": "2026-11-05T19:48:52.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}