Rate-Limiting Bypass in API Gateway from Eclipse

CVE-2026-110726

What is CVE-2026-110726?

The API Gateway by Eclipse has a vulnerability where the default rate-limit key resolver, ClientIpKeyResolver, processes the leftmost element of the X-Forwarded-For request header to determine unique client keys. This method allows attackers to forge multiple headers, each generating a separate rate-limit bucket. As a result, they can effectively bypass rate limits set by the gateway on any route using the default configuration. This flaw poses significant risks to API security by enabling excessive requests and potential abuse.

References