CVE-2026-57942: LibreTranslate IP Spoofing & Rate Limit Bypass Vulnerability

Technical summary

The vulnerability resides in LibreTranslate's get_remote_address() function, which reads the X-Forwarded-For header to determine client IP addresses without validating whether the request originates from a trusted proxy. CWE-348 (Clumsy Cryptographic Practices) reflects improper trust of untrusted input in a security-critical context. An attacker can craft HTTP requests with arbitrary X-Forwarded-For values, causing the application to record and trust forged source IPs. This circumvents per-IP rate limiting and flood detection mechanisms that depend on accurate client identification. The fix was committed as commit 397fd22, addressing the lack of trusted proxy validation.

Business impact

Threat actors can conduct sustained API abuse attacks without triggering rate-limit blocks. This degrades service quality for legitimate users, increases infrastructure costs from handling high request volumes, and may enable targeted denial-of-service against LibreTranslate deployments. Organizations relying on rate limiting to protect their translation API are left unprotected if they run unpatched versions. The attack requires no authentication and is trivial to execute, making it attractive to competitors seeking to disrupt service or to malicious actors testing defenses.

Affected systems

LibreTranslate through version 1.9.7 is affected. The vulnerability exists in the IP address extraction logic used across all request handling, so any deployment of an unpatched version is vulnerable. Self-hosted instances and any service exposing LibreTranslate's API are in scope. No authentication is required to exploit this issue.

Exploitability

Exploitation is straightforward: an attacker sends HTTP requests with crafted X-Forwarded-For headers containing arbitrary IP addresses. The attack has a network attack vector (AV:N), requires no special access (PR:N), no user interaction (UI:N), and succeeds in uncontained scope (S:U). The low attack complexity (AC:L) means no special tools or unusual conditions are needed. The impact is availability-focused: attackers can sustain high request rates without rate-limit consequences. This is a low-to-moderate risk vulnerability with high practical exploitability for anyone seeking to flood or disrupt the service.

Remediation

Update LibreTranslate to a version incorporating commit 397fd22 or later. The fix implements trusted proxy validation so that X-Forwarded-For headers are only trusted when they originate from explicitly configured, authorized proxy servers. Organizations should also audit their deployment architecture: if LibreTranslate is not behind a trusted reverse proxy or load balancer, the X-Forwarded-For header should not be trusted at all, and the function should read only the actual TCP connection source. Consider implementing additional rate limiting at the firewall or API gateway layer, independent of application-level per-IP checks.

Patch guidance

Apply updates to LibreTranslate versions that include the fix from commit 397fd22. Verify the patched version against the official LibreTranslate release notes and repository. If you operate a self-hosted instance, pull the latest stable release or build from the patched commit. If you use LibreTranslate as a service, contact the provider to confirm they have deployed the patch. After patching, test that rate limiting functions as expected by verifying that requests from a single IP address are throttled appropriately.

Detection guidance

Monitor for suspicious patterns in X-Forwarded-For header values, particularly where the header contains IP addresses that do not correspond to legitimate proxy infrastructure. Log and alert on requests with highly variable or obviously spoofed addresses (e.g., private IP ranges, reserved addresses, or addresses from unexpected geographic regions). Review API access logs for unusual spikes in traffic from diverse IP sources within short time windows—a signature of header spoofing attacks. If rate limiting is unexpectedly ineffective, investigate whether the application is reading untrusted headers.

Why prioritize this

Although this is a MEDIUM severity issue (CVSS 5.3), it should be prioritized by teams running or consuming LibreTranslate APIs. The vulnerability directly undermines rate limiting, a foundational defense against abuse and denial-of-service. It requires no authentication, zero user interaction, and is trivial to exploit at scale. Organizations with public-facing translation APIs or those vulnerable to competitive disruption should patch promptly. The lack of confidentiality or integrity impact prevents this from being HIGH severity, but the availability risk and ease of exploitation warrant urgent remediation.

Risk score, explained

CVSS 5.3 (MEDIUM) reflects an unauthenticated, network-accessible vulnerability with low attack complexity that impacts availability (via circumvented rate limiting) but does not directly compromise confidentiality or integrity. The scope is unchanged, and no special privileges are required. The score accurately captures that this is a focused denial-of-service risk rather than a system-wide compromise threat, but the practical exploitability and ease of abuse elevate concern within organizations relying on API rate limiting for operational resilience.

Frequently asked questions