In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22201-1 advisory.

    Changes in hauler:

    - update vendor:
      * CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in         `ClientIPFromXFF` via `X-Forwarded-For (bsc#1287881)

    - update to 2.1.2 (bsc#1285270, CVE-2026-78669):
      * It fixes credential and presigned url leaks, local chart         handling, haul formats from `--filename`, and `hauler store         copy` with image-type files and cosign bundles. It adds         `hauler`, `hauler-dev`, and `hauler@` homebrew casks, and it         is the first release published through them. It also bumps go         to `1.27.2`.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a
    configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to
    that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy
    address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.
    (CVE-2026-114437)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a     configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to     that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy     address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.
    (CVE-2026-114437)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
374761	openSUSE 16 Security Update : hauler (openSUSE-SU-2026:22201-1)	Nessus	SuSE Local Security Checks	Local	medium
477241	SCA: security update for github.com/go-chi/chi/v5 (GHSA-j6qf-3m9c-vwj3)	Tenable Cloud Security	SCA Checks	Local	medium
477241	SCA: security update for github.com/go-chi/chi/v5 (GHSA-j6qf-3m9c-vwj3)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
370553	Linux Distros Unpatched Vulnerability : CVE-2026-114437	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-114437

medium

Tenable Plugins

medium

medium

medium

medium