ETK-2026-2557Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2557",
  "cve_id": null,
  "display_id": "ETK-2026-2557",
  "ghsa_id": "GHSA-hvmx-g7m2-vqx8",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Forwarded-header trust bypass in openwisp-radius",
  "summary": "openwisp-radius versions before 1.3.3 can treat a spoofed forwarded client address as the source address for FreeRADIUS API access decisions. An unauthenticated attacker may submit requests as though they originated from an allowed host when they can reach the API through a proxy that preserves attacker-supplied forwarding headers and know an allowed address.",
  "mitigation": "Upgrade openwisp-radius to version 1.3.3. Configure proxies to discard client-provided forwarding headers and set client addresses only from trusted proxy connections.",
  "vendor": "pip",
  "product": "pip:openwisp-radius",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.3.3"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.3.3"
      ],
      "package_name": "openwisp-radius",
      "purl": "pkg:pypi/openwisp-radius"
    }
  ],
  "cwes": [
    290
  ],
  "cvss_score": 7,
  "cvss_src": "ethiack_provisional",
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.17076318333333,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-23T21:57:26+00:00",
      "days": -1.0303208025578703,
      "is_lower_bound": true,
      "measured_at": "2026-10-24T22:41:05.742498+00:00",
      "url": "https://github.com/openwisp/openwisp-radius/security/advisories/GHSA-hvmx-g7m2-vqx8"
    }
  }
}