CVE-2026-108522: Studio-Saelix Sencho login rate-limit bypass via X-Forwarded-For header

CVE-2026-108522 · Severity: high · CVSS 8.3 · Published 2026-10-11

Sencho is a self-hosted Docker Compose management platform. An attacker can bypass login rate-limiting by spoofing the X-Forwarded-For header, enabling unlimited password guessing against any account, including the administrator. Admin takeover leads directly to host-level compromise since Sencho mounts the Docker socket.

Technologies: Studio-Saelix Sencho. Vendors: Studio-Saelix.

Quick answers

Is CVE-2026-108522 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-108522 being exploited in the wild.
How severe is CVE-2026-108522?
High severity, with a CVSS score of 8.3, published 11 October 2026.
Which products and versions are affected?
Studio-Saelix Sencho up to 0.94.1.
Is there a fix for CVE-2026-108522?
Yes: fixed in Fixed in commit 79b86ddcd4aefdd6941f098e35990ab397b13c72. Until then: Configure an allowlist of trusted reverse-proxy IP addresses and do not honor X-Forwarded-For from untrusted sources. As a secondary defense, implement a per-account rate limit independent of client-supplied headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108522 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-108522?
Check whether you run Studio-Saelix Sencho at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Fixed in commit 79b86ddcd4aefdd6941f098e35990ab397b13c72

Configure an allowlist of trusted reverse-proxy IP addresses and do not honor X-Forwarded-For from untrusted sources. As a secondary defense, implement a per-account rate limit independent of client-supplied headers.

Technical details

The /api/auth/login endpoint implements rate-limiting keyed on the X-Forwarded-For header without validating that requests originate from a trusted reverse proxy (CWE-290, CWE-307). An attacker can rotate the header value on each request to obtain a fresh rate-limit quota, bypassing the 5-attempt limit per identity. The vendor confirms the fix ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by account identity.

Affected products

  • Studio-Saelix Sencho up to 0.94.1

Timeline

  • 2026-10-11: disclosed
  • 2026-07-16: exploited: Proof of concept published on GitHub

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.