Finding / paperclip

2026-09-21-paperclip-v2026-916-0-x-forwarded-host-is-honored-only-from-a-trusted-proxy

v2026.916.0: X-Forwarded-Host is honored only from a trusted proxy. The same-origin guard used to accept a forwarded host from any direct client, letting a caller add its own header value to the trusted-origin set. It now requires the immediate peer to pass TRUST_PROXY.

Channel: tagged-release. Half: defect (closed). Date: 2026-09-16.

Operator consequence: Behind a reverse proxy, confirm TRUST_PROXY is set before upgrading or origin checks fall back to the raw Host header. Directly exposed pre-916.0 instances had a spoofable origin check.

Receipt

Finding metadata

Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0

Finding ID: 2026-09-21-paperclip-v2026-916-0-x-forwarded-host-is-honored-only-from-a-trusted-proxy

Profile citations

  • Paperclip / claim / forwarded-host-trusted-proxy

Source links

Primary links, including exact changelog lines when available.