Executive brief
LibreTranslate, an open-source machine translation service, is vulnerable to a flaw that allows users to hide their true identity. By providing fake network addresses in their requests, attackers can bypass usage limits and security bans intended to prevent service abuse. This could lead to increased operational costs or service outages if the translation engine is overwhelmed by automated traffic.
Technical details
An IP spoofing vulnerability exists in the get_remote_address() function of LibreTranslate through version 1.9.7. The application trusts the first value of the X-Forwarded-For HTTP header without validating it against a list of trusted proxies. An unauthenticated remote attacker can provide arbitrary IP addresses in this header to reset per-IP rate limit counters and bypass flood bans. This allows for unlimited API abuse and resource exhaustion. The issue is fixed in commit 397fd22 by introducing a --trust-forwarded-for flag that is disabled by default.
Affected products
- LibreTranslate LibreTranslate through 1.9.7
Timeline
- 2026-06-13: disclosed: Issue reported on GitHub
- 2026-06-14: patched: Fix merged in commit 397fd22
- 2026-06-29: advisory: CVE published
References
- https://github.com/LibreTranslate/LibreTranslate/commit/397fd224080515d4001a1bc60c8fed53e3c56b6f
- https://github.com/LibreTranslate/LibreTranslate/issues/986
- https://github.com/LibreTranslate/LibreTranslate/pull/987
- https://www.vulncheck.com/advisories/libretranslate-ip-spoofing-via-x-forwarded-for-header