CVE-2026-82815 Overview
CVE-2026-82815 is an improper access control vulnerability in MegaEase EaseProbe versions up to 2.3.0. The flaw resides in the realIP function of web/server.go within the Middleware component. The function trusts client-supplied HTTP headers (X-Forwarded-For, X-Real-IP, and True-Client-IP) without validation. Remote attackers can manipulate these headers to spoof source IP addresses and bypass IP-based access controls. A public exploit has been released. According to the disclosure, the vendor was contacted but did not respond. This weakness is categorized under [CWE-266: Incorrect Privilege Assignment].
Critical Impact
Attackers can spoof trusted source IPs by injecting forwarded-for headers, bypassing IP allowlists that protect EaseProbe management surfaces.
Affected Products
- MegaEase EaseProbe versions through 2.3.0
- The realIP function in web/server.go
- The Middleware component handling forwarded IP headers
Discovery Timeline
- 2026-08-31 - CVE-2026-82815 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-82815
Vulnerability Analysis
EaseProbe is an open-source health and status monitoring tool written in Go. The web server component exposes endpoints that identify the client IP address using the realIP middleware function in web/server.go. That function reads the X-Forwarded-For, X-Real-IP, and True-Client-IP request headers to determine the caller's origin address.
The implementation does not verify that these headers originated from a trusted upstream proxy. Any remote client can set the headers directly, causing the middleware to report an attacker-chosen address as the real client IP. When operators rely on that value for IP allowlists, audit logging, or rate limiting, the trust boundary collapses.
The attack requires no authentication and no user interaction. A single HTTP request with a crafted header is sufficient to influence access decisions or pollute telemetry.
Root Cause
The root cause is unconditional trust in client-controlled HTTP headers. Proper implementations restrict header parsing to requests arriving from a configured set of trusted proxies, or ignore forwarded headers when the service is directly exposed. EaseProbe's middleware applies neither control, which maps to [CWE-266] because privilege decisions rely on a spoofable identifier.
Attack Vector
A remote attacker sends an HTTP request to an EaseProbe endpoint and includes headers such as X-Forwarded-For: 127.0.0.1, X-Real-IP: 10.0.0.1, or True-Client-IP: <trusted-ip>. The middleware returns the spoofed value for downstream authorization checks. If the deployment restricts administrative or status endpoints by source IP, the attacker gains access as if connecting from the allowlisted network. A proof-of-concept is available at the GitHub PoC Repository.
No verified exploit code is reproduced here. See the VulDB CVE-2026-82815 entry for additional technical context.
Detection Methods for CVE-2026-82815
Indicators of Compromise
- Inbound HTTP requests to EaseProbe endpoints containing X-Forwarded-For, X-Real-IP, or True-Client-IP headers from networks that do not host a legitimate reverse proxy.
- Access log entries showing internal or loopback addresses (127.0.0.1, 10.0.0.0/8) recorded as the source IP for requests that arrived over external interfaces.
- Successful access to restricted EaseProbe management or status routes from unexpected upstream sources.
Detection Strategies
- Compare the TCP-layer remote address recorded by the network stack against the application-layer client IP logged by EaseProbe. Divergence outside of trusted proxy CIDRs indicates spoofing attempts.
- Alert on requests that include multiple or malformed forwarded-IP headers, which are common in exploitation traffic.
- Review reverse proxy and WAF logs for header injection patterns targeting EaseProbe hostnames or ports.
Monitoring Recommendations
- Ingest EaseProbe web server logs and upstream proxy logs into a centralized analytics platform to correlate spoofed header activity across layers.
- Baseline the set of source IPs that legitimately reach EaseProbe and alert on deviations, especially requests to sensitive routes.
- Track authentication and authorization outcomes on EaseProbe endpoints to surface access decisions influenced by forwarded headers.
How to Mitigate CVE-2026-82815
Immediate Actions Required
- Place EaseProbe behind an authenticated reverse proxy and remove any direct network exposure of the service.
- Strip incoming X-Forwarded-For, X-Real-IP, and True-Client-IP headers at the edge before traffic reaches EaseProbe, then re-inject them from the trusted proxy.
- Replace IP-based access controls with authenticated access controls such as mTLS or bearer tokens until a fixed release is available.
Patch Information
At the time of publication, no vendor patch has been released. According to the disclosure summary, MegaEase was contacted before public disclosure but did not respond. Monitor the MegaEase EaseProbe repository for updates addressing the realIP function in web/server.go.
Workarounds
- Restrict network reachability to EaseProbe using firewall rules or security groups so that only the reverse proxy can connect.
- Configure the reverse proxy (for example, NGINX or Envoy) to overwrite forwarded-IP headers rather than append to them, preventing client-supplied values from surviving.
- Disable or firewall off the EaseProbe web interface entirely if it is not required for operations.
- Audit any downstream systems that consume EaseProbe logs to ensure spoofed IP values are not treated as authoritative for security decisions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.