PT-2026-53661 · Libretranslate · Libretranslate

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-57942

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

LibreTranslate through 1.9.7, fixed in commit 397fd22, contains an IP spoofing vulnerability in the get remote address() function that allows unauthenticated attackers to spoof client IP addresses by injecting arbitrary values into the X-Forwarded-For header without trusted proxy validation. Attackers can bypass per-IP rate limiting and flood bans by supplying forged addresses in the X-Forwarded-For header to enable unlimited API abuse.

Exploit

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2026-57942

Affected Products

Libretranslate

References · 5

• 🔥 https://github.com/LibreTranslate/LibreTranslate/issues/986 · Exploit
• https://github.com/LibreTranslate/LibreTranslate/commit/397fd224080515d4001a1bc60c8fed53e3c56b6f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57942 · Security Note
• https://github.com/LibreTranslate/LibreTranslate/pull/987 · Note
• https://vulncheck.com/advisories/libretranslate-ip-spoofing-via-x-forwarded-for-header · Note