The vulnerability lies in the default ClientIpKeyResolver of the api-gateway, which constructs a rate‑limit bucket key from the first token of the X‑Forwarded-For request header. Because the header value is supplied by the client and is not checked against a list of trusted proxies, an attacker can supply arbitrary values and cause the gateway to create a new, distinct bucket for each unique header value. The result is that the gateway’s per‑route request‑rate limiting can be completely bypassed. This weakness is an example of improper input validation and unchecked data usage, reflected in the CWE identifiers 348, 770, and 807. The practical impact is that an attacker can overwhelm downstream services or bypass throttling intended to protect both the gateway and the services it fronts.

Eclipse Foundation’s Eclipse Connected Services Platform. The affected product is the api‑gateway component. All releases up to and including version 1.7.3 are vulnerable; no fixed version is listed in the data but users should upgrade to a release newer than 1.7.3.

The CVSS score of 6.5 categorizes the issue as a moderate severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote HTTP request where the attacker controls the X‑Forwarded‑For header, enabling the bypass of rate‑limit controls even when the gateway is configured for production use.