# CVE-2026-108522: Studio-Saelix Sencho login rate-limit bypass via X-Forwarded-For header

Source: https://junglewise.ai/threats/cve-2026-108522-a-vulnerability-was-found-in-studio-saelix-sencho-up-to-0-94-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-11. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-108522 · Severity: high · CVSS 8.3 · Published 2026-10-11

Sencho is a self-hosted Docker Compose management platform. An attacker can bypass login rate-limiting by spoofing the X-Forwarded-For header, enabling unlimited password guessing against any account, including the administrator. Admin takeover leads directly to host-level compromise since Sencho mounts the Docker socket.

Technologies: [Studio-Saelix Sencho](https://junglewise.ai/threats/technologies/sencho). Vendors: [Studio-Saelix](https://junglewise.ai/threats/vendors/studio-saelix).

## Quick answers

**Is CVE-2026-108522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-108522 being exploited in the wild.

**How severe is CVE-2026-108522?** High severity, with a CVSS score of 8.3, published 11 October 2026.

**Which products and versions are affected?** Studio-Saelix Sencho up to 0.94.1.

**Is there a fix for CVE-2026-108522?** Yes: fixed in Fixed in commit 79b86ddcd4aefdd6941f098e35990ab397b13c72. Until then: Configure an allowlist of trusted reverse-proxy IP addresses and do not honor X-Forwarded-For from untrusted sources. As a secondary defense, implement a per-account rate limit independent of client-supplied headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-108522 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-108522?** Check whether you run Studio-Saelix Sencho at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed in commit 79b86ddcd4aefdd6941f098e35990ab397b13c72

Configure an allowlist of trusted reverse-proxy IP addresses and do not honor X-Forwarded-For from untrusted sources. As a secondary defense, implement a per-account rate limit independent of client-supplied headers.

## Technical details

The /api/auth/login endpoint implements rate-limiting keyed on the X-Forwarded-For header without validating that requests originate from a trusted reverse proxy (CWE-290, CWE-307). An attacker can rotate the header value on each request to obtain a fresh rate-limit quota, bypassing the 5-attempt limit per identity. The vendor confirms the fix ignores forwarding headers by default, accepts them only from explicitly configured proxy CIDRs, and adds a separate failed-attempt limit keyed by account identity.

## Affected products

- Studio-Saelix Sencho up to 0.94.1

## Timeline

- 2026-10-11: disclosed
- 2026-07-16: exploited: Proof of concept published on GitHub

## References

- [https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a](https://gist.github.com/jovair1994/839c8aaca1f37567cdd02e107a389f6a)
- [https://github.com/Studio-Saelix/sencho/](https://github.com/Studio-Saelix/sencho/)

## Related threats

- [Studio-Saelix Sencho server-side request forgery in git-sources endpoint](https://junglewise.ai/threats/cve-2026-108523-a-vulnerability-was-determined-in-studio-saelix-sencho-up-to-0)
- [Studio-Saelix Sencho server-side request forgery in Add Remote Node API](https://junglewise.ai/threats/cve-2026-108521-a-vulnerability-has-been-found-in-studio-saelix-sencho-up-to-0)