CVE-2026-108736

Name of the Vulnerable Software and Affected Versions Speedtest Tracker versions prior to 1.15.1

Description An IP allowlist bypass allows unauthenticated remote attackers to evade ALLOWED IPS and Prometheus allowlists. This occurs because the bootstrap/app.php file trusts every peer as a proxy, enabling attackers to spoof X-Forwarded-For headers with an allowlisted address. Consequently, unauthorized users can access the /prometheus endpoint to read metrics and reach other protected web and API endpoints.

Recommendations Update Speedtest Tracker to a version later than 1.15.0.