In the Eclipse Connected Services Platform API Gateway, the default rate‑limit key resolver builds a bucket key from the leftmost value of the X‑Forwarded‑For header. The header value originates from the client and is not checked against a trusted‑proxy list. An attacker can submit arbitrary X‑Forwarded‑For values; each distinct value creates a new rate‑limit bucket, allowing the attacker to send requests at an unlimited rate. This flaw represents an improper authentication and information‑exposure weakness, identified as CWE‑290 and CWE‑644.

All releases of the Eclipse Connected Services Platform API Gateway through version 1.7.3 are affected. No later versions are noted in the advisory as fixed. The product is distributed by the Eclipse Foundation.

The CVSS score of 7.5 classifies this as a high‑severity weakness. The EPSS score of less than 1 % indicates a low likelihood of exploitation at this time, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only the ability to send HTTP requests with a custom X‑Forwarded‑For header, which is typically possible in most network contexts. The attack vector is straightforward: an attacker sends requests containing crafted X‑Forwarded‑For values, thereby evading rate limiting on any configured route. While no code execution or privilege escalation is involved, the ability to bypass rate limiting can lead to denial‑of‑service or facilitate secondary attacks by flooding downstream systems.