Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.5, published 14 July 2026.

Which products and versions are affected?

Almeidapaulopt TSDProxy <= 2.3.4; github.com/almeidapaulopt/tsdproxy (Go) < 3.0.0-alpha.3.

Is there a fix for This vulnerability?

A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

almeidapaulopt TsDProxy IP spoofing via X-Forwarded-For injection

Q: Is there a fix for This vulnerability?

A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.5 · Published 2026-07-14

TsDProxy is a tool used to provide secure access to internal services via Tailscale. A vulnerability in how it handles web traffic allows users to fake their source IP address. This could allow an attacker to bypass security restrictions, such as admin panels that are only supposed to be accessible from specific locations, or to hide their identity in activity logs.

Technologies: github.com/almeidapaulopt/tsdproxy (Go). Vendors: Go.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.5, published 14 July 2026.
Which products and versions are affected?: Almeidapaulopt TSDProxy <= 2.3.4; github.com/almeidapaulopt/tsdproxy (Go) < 3.0.0-alpha.3.
Is there a fix for This vulnerability?: A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run Almeidapaulopt TSDProxy or github.com/almeidapaulopt/tsdproxy (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The HTTP reverse proxy handler in tsdproxy's `internal/proxymanager/port.go` fails to sanitize incoming 'X-Forwarded-For' and 'X-Real-IP' headers before forwarding requests. When `r.SetXForwarded()` is called, it appends the actual client IP to any existing, attacker-supplied 'X-Forwarded-For' values rather than replacing them. An authenticated Tailscale user can inject arbitrary IP addresses into these headers to bypass IP-based access control lists (ACLs), rate limits, or geo-blocking enforced by backend applications that trust the first element of the header chain. The issue is fixed in version 2.3.5 by explicitly stripping these headers before the proxy re-adds the authoritative client IP.

Affected products

almeidapaulopt tsdproxy <= 2.3.4

Timeline

2026-06-03: disclosed
2026-07-14: advisory: GitHub Advisory published
2026-07-14: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.