Pingora versions before 0.9.0 fail strip client‑specified Connection headers and the headers they nominate before forwarding an HTTP/1 upstream request. RFC 9110 mandates that intermediaries remove these hop‑by‑hop headers, but Pingora’s earlier code did not, allowing an attacker to cause a downstream HTTP/1 proxy (e.g., Go’s net/http/httputil.ReverseProxy) to strip important request headers such as X‑Forwarded‑For. When the origin trusts those sanitized headers for IP‑based authorization, the attacker can effectively bypass ACL checks and gain unauthorized access to protected endpoints.

The vulnerability affects Cloudflare Pingora proxy deployments running any version older than 0.9.0. Attackers must target a configuration where Pingora forwards to an HTTP/1 upstream that honors Connection headers and an origin that relies on the sanitized forwarded headers for authorization, such as the Go ReverseProxy example described.

The CVSS score of 8.7 indicates high severity, and the vulnerability can be exploited remotely by an unauthenticated attacker who can send crafted requests to Pingora. Because the exploit requires a specific chained deployment architecture, the likelihood of widespread exploitation may be lower, but the impact is severe for affected deployments that trust forwarded headers for ACL enforcement. This issue is not listed in the CISA KEV catalog, and the EPSS score of 0.00335 (less than 1%) indicates a very low but non‑zero probability of exploitation.