Finding / paperclip
2026-09-21-paperclip-v2026-916-0-x-forwarded-host-is-honored-only-from-a-trusted-proxy
v2026.916.0: X-Forwarded-Host is honored only from a trusted proxy. The same-origin guard used to accept a forwarded host from any direct client, letting a caller add its own header value to the trusted-origin set. It now requires the immediate peer to pass TRUST_PROXY.
Channel: tagged-release. Half: defect (closed). Date: 2026-09-16.
Operator consequence: Behind a reverse proxy, confirm TRUST_PROXY is set before upgrading or origin checks fall back to the raw Host header. Directly exposed pre-916.0 instances had a spoofable origin check.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-paperclip-v2026-916-0-x-forwarded-host-is-honored-only-from-a-trusted-proxy
Profile citations
- Paperclip / claim / forwarded-host-trusted-proxy
Source links
Primary links, including exact changelog lines when available.