Cairn
NousResearch/hermes-agent

X-Forwarded-For IP spoofing in auth flows

Cluster 90702 · dashboard. Data as of

Nothing open on GitHub. Fix merged in #133367 on 5 Oct 2026. Check it covers your case.

The short answer

0open issues
0open PRs
4items grouped
Known?
Yes. 4 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #133367. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #133367. That is separate from the fix event.
Still open
Nothing open on GitHub.

These items address a security issue where client-controlled X-Forwarded-For headers could be used to spoof IP addresses, potentially bypassing per-IP rate limits and attribution in authentication endpoints. The fix involves trusting only the rightmost value in the header rather than client-supplied ones.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #133367 fix(dashboard-auth): ignore spoofed X-Forwarded-For for login limits

    merged to main

    files: hermes_cli/dashboard_auth/request_utils.py, hermes_cli/dashboard_auth/routes.py, tests/hermes_cli/test_dashboard_auth_native_flow.py, tests/hermes_cli/test_dashboard_auth_password_login.py, website/docs/user-guide/features/web-dashboard.md

2 PRs closed without merging

From the close comments: duplicate 1 · superseded by another PR 1

  • #90736 fix(dashboard-auth): stop trusting client-controlled X-Forwarded-For for rate-limiting/attribution · superseded by another PR → #133367, #90702
  • #91232 fix(auth): use rightmost X-Forwarded-For value to prevent IP spoofing (#90702) · duplicate → #90736
Closed issues · 1
  • Closed#90702[Bug]: /auth/native/authorize pending store fillable for 10min via spoofed X-Forwarded-For (per-IP cap bypass)
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.50: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
dashboard
Merged PRs
#133367
Closed issues
1
Attempts
2 PRs closed without merging
Fix link checked
5 Oct 2026

For your agent

The same facts, typed.

cluster/90702.json
cluster/90702.md