The RealIP middleware in go-chi chi versions 5.2.1 through 5.2.x blindly trusts the first value of the X-Forwarded-For HTTP header. Because the header value is not validated, the middleware accepts any spoofed address supplied by an external client, allowing an attacker to impersonate another IP address. This flaw enables the attacker to bypass IP‑based access controls, evade rate limits, and create false log entries, thereby compromising confidentiality, integrity, and availability of services that rely on accurate client IPs. The weakness is classified as a CWE‑290 instance of improper restriction of API privileges.

go‑chi chi is affected. The vulnerability applies to all installed releases from 5.2.1 up to, but not including, 5.3.0. Users running any of these versions use the default RealIP middleware configuration that trusts all X‑Forwarded‑For values.

The CVSS score of 6.9 indicates a moderate severity, and the EPSS score is not available, suggesting that limited exploitation data is publicly known. The issue is not listed in the CISA KEV catalog. As the flaw stems from the blind trust of a request header, the attack is likely remote via HTTP traffic to any exposed service that uses the RealIP middleware. Attackers need only craft an HTTP request bearing a forged X‑Forwarded‑For header; if the target application performs IP‑based filtering or logging based on the derived address, the attacker can subvert those controls. No additional privileged access or code execution is required, but the potential to bypass security mechanisms makes it a credible threat to production deployments.