CVE-2026-86041— ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Quick assessment

Affected

mayswind ezbookkeeping

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ezBookkeeping 是一款开源、自托管的个人财务管理应用。在版本 0.10.0 至 1.6.0 期间，ezBookkeeping 使用构建 Gin 路由器时未配置，导致会信任被伪造的请求头。未认证的远程攻击者可提交一个白名单地址，从而绕过或的访问控制限制。不过，执行受保护操作时仍需提供有效的 MCP 或 API 令牌。当此类操作发生时，相同的伪造 IP 值会被记录在字段和请求日志中，使系统误将活动归因于受信任的主机而非实际攻击者。该问题已在 1.6.0 版本中修复。

CVSS 5.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1070.004 · File Deletion T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header

Source: CVE Program / CVE List V5

Vulnerability Description

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can supply an allowlisted address to bypass the mcp_allowed_remote_ips or api_token_allowed_remote_ips gate. A valid MCP or API token remains required for protected actions. When such actions occur, the same spoofed value is stored in Transaction.CreatedIp and the request log, attributing activity to the trusted host instead of the attacker. This issue is fixed in version 1.6.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用不可信的源

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
mayswind	ezbookkeeping	>= 0.10.0, < 1.6.0	-

II. Public POCs for CVE-2026-86041

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-86041

请登录查看更多情报信息。

Other References for CVE-2026-86041 (3)

https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0 x_refsource_MISC
https://github.com/mayswind/ezbookkeeping/security/advisories/GHSA-wchh-mrv2-5h4q x_refsource_CONFIRM
https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-86041

IV. Related Vulnerabilities

Same product: ezbookkeeping

Same vendor: mayswind

Same weakness: CWE-348