Rails Action Pack: IP spoofing via Forwarded header in RemoteIp
Summary
Action Pack in Rails 8.1.0 to 8.1.4 with Rack 3 takes request.remote_ip from the client-supplied Forwarded header when a reverse proxy passes that header through unchanged. An unauthenticated remote attacker can therefore spoof the client address, which may bypass IP-based access controls and rate limits (including the default rate_limit by:) and falsify client addresses in logs. The attack requires a specific proxy configuration and applications that rely on request.remote_ip for security decisions.
Affected
- Rails Action Pack 8.1.0 to 8.1.4 (advisory range >= 8.1, < 8.1.4.1)
- Only applications running Rack 3 (Rack 2.2 reads only X-Forwarded-For)
- Only applications behind a proxy that does not remove or overwrite a client-supplied Forwarded header
Fixed in
- Upgrade to Rails 8.1.4.1 (Action Pack 8.1.4.1)
Workaround
- Configure the reverse proxy to remove or overwrite any client-supplied Forwarded header.
- If the proxy sets X-Forwarded-For, set Rack::Request.forwarded_priority = [:x_forwarded] in an initializer.
- Without X-Forwarded-For, the upgrade alone is not sufficient; the proxy configuration must be changed.
Exploitation
- Not known to be exploited in the wild.
- Not listed in CISA KEV.
- No public proof-of-concept found in the research performed; absence of a PoC is not proof that none exists.
Our recommendation
- Identify Rails 8.1.x applications running on Rack 3 (check Gemfile.lock).
- Test the upgrade to 8.1.4.1 in a test environment first; the fix can raise IpSpoofAttackError (HTTP 500) when the headers name different clients.
- Check that the reverse proxy removes or overwrites client-supplied Forwarded headers.
- Review access control, rate limiting and audit logic that depends on request.remote_ip.
- Note that the same release fixes a more severe Active Storage issue (GHSA-f3w6-w445-fwh9); patch Rails 8.1 applications accordingly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-2gff-2mmg-m73p github.com
- Fix commit 2a01a5a github.com
- Rails 8.1.4.1 release github.com
- Rails security release announcement rubyonrails.org
- OSV GHSA-2gff-2mmg-m73p osv.dev
- ActionDispatch::RemoteIp API documentation api.rubyonrails.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:16.
Original description (NVD)
Action Pack is a framework for handling and responding to web requests. From 8.1 until 8.1.4.1, Since Rails 8.1.0, ActionDispatch::RemoteIp derives request.remote_ip from Rack::Request#forwarded_for, which under Rack 3 reads the RFC 7239 Forwarded header in preference to X-Forwarded-For. When a reverse proxy appends the client address to X-Forwarded-For but passes a client-supplied Forwarded header through unchanged, request.remote_ip returns an address chosen by the client, and the IP spoofing check does not raise, because it compares only Client-Ip with the forwarded addresses. An unauthenticated attacker could therefore spoof request.remote_ip, possibly bypassing IP-based access controls and rate limits keyed on the client address (including the default by: of rate_limit), and falsifying the client address in logs. An application is affected if it meets all of these requirements: Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, forwarded_for reads only X-Forwarded-For. Is served behind a proxy that does not remove or overwrite a client-supplied Forwarded header. Relies on request.remote_ip for access control, rate limiting, or auditing. The fix detects a spoofed Forwarded header only when the proxy also sets X-Forwarded-For. An application whose proxy passes a client-supplied Forwarded header through and sets no X-Forwarded-For remains exposed after upgrading, and should configure the proxy to remove or overwrite Forwarded, or apply the workaround below. This issue is fixed in version 8.1.4.1.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.