# CVE-2026-86041: ezBookkeeping IP spoofing via unsanitized X-Forwarded-For header

Source: https://junglewise.ai/threats/cve-2026-86041-ezbookkeeping-is-an-open-source-self-hosted-personal-finance  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-86041 · Severity: medium · CVSS 4 · Published 2026-11-04

ezBookkeeping is a self-hosted personal finance application that tracks income, expenses, and transactions. The application was not validating the X-Forwarded-For header, allowing attackers to forge their source IP address and bypass IP allowlist protections designed to restrict access to sensitive features. An attacker with a valid API token or MCP token can impersonate a trusted network location, causing illicit activity to be logged as if it originated from that trusted address.

Technologies: [github.com/mayswind/ezbookkeeping (Go)](https://junglewise.ai/threats/technologies/github-com-mayswind-ezbookkeeping), [Mayswind ezBookkeeping](https://junglewise.ai/threats/technologies/ezbookkeeping). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Mayswind](https://junglewise.ai/threats/vendors/mayswind).

## Quick answers

**Is CVE-2026-86041 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86041 being exploited in the wild.

**How severe is CVE-2026-86041?** Medium severity, with a CVSS score of 4, published 4 November 2026.

**Which products and versions are affected?** github.com/mayswind/ezbookkeeping (Go) >= 0.10.0, < 1.6.0, SEMVER:introduced=0.10.0,fixed=1.6.0; Mayswind ezBookkeeping 0.10.0 to 1.5.x.

**Is there a fix for CVE-2026-86041?** Yes. github.com/mayswind/ezbookkeeping (Go): upgrade to 1.6.0 or later. Until then: Configure trusted proxy ranges in the ezBookkeeping configuration file to restrict which upstream proxies may set X-Forwarded-For headers, or restrict API and MCP token access to trusted networks until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86041 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-86041?** Check whether you run github.com/mayswind/ezbookkeeping (Go) or Mayswind ezBookkeeping at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/mayswind/ezbookkeeping (Go): upgrade to 1.6.0 or later

  ```sh
  go get github.com/mayswind/ezbookkeeping@v1.6.0
  ```


Configure trusted proxy ranges in the ezBookkeeping configuration file to restrict which upstream proxies may set X-Forwarded-For headers, or restrict API and MCP token access to trusted networks until upgrading.

## Technical details

The vulnerability is a client IP spoofing issue caused by misconfiguration of the Gin web framework's proxy trust settings. When constructing the Gin router with gin.New() without calling SetTrustedProxies(), the c.ClientIP() method naively trusts the X-Forwarded-For header value, allowing unauthenticated remote attackers to supply arbitrary addresses. An attacker with valid MCP or API token credentials can bypass mcp_allowed_remote_ips or api_token_allowed_remote_ips IP-based access controls and have their actions logged with a spoofed source IP in both TransactionCreatedIp and request logs.

## Affected products

- mayswind ezBookkeeping 0.10.0 to 1.5.x

## Identifiers

- CVE-2026-86041
- GHSA-wchh-mrv2-5h4q

## Timeline

- 2026-07-19: patched
- 2026-11-04: disclosed

## References

- [https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986](https://github.com/mayswind/ezbookkeeping/commit/d79a5beb8037e529dc4dc64a6d22bd2d02b2e986)
- [https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0](https://github.com/mayswind/ezbookkeeping/releases/tag/v1.6.0)

## Related threats

- [ezBookkeeping privilege escalation in token refresh](https://junglewise.ai/threats/cve-2026-105131-ezbookkeeping-1-2-0-before-2-0-1-contains-a-privilege-escalation)
- [mayswind ezBookkeeping TOTP passcode replay in authentication](https://junglewise.ai/threats/cve-2026-94112-mayswind-ezbookkeeping-before-2-0-0-fails-to-invalidate-totp)
- [GO-2025-3466 - Missing rate limit in MaysWind ezBookkeeping in github.com/mayswind/ezbookkeeping](https://junglewise.ai/threats/cve-2024-57603-missing-rate-limit-in-mayswind-ezbookkeeping)
- [GO-2025-3474 - MaysWind ezBookkeeping has Improper Privilege Management in github.com/mayswind/ezbookkeeping](https://junglewise.ai/threats/cve-2024-57604-mayswind-ezbookkeeping-has-improper-privilege-management)