Skip to content
OpenAdvisories

Package · Go

github.com/almeidapaulopt/tsdproxy

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • High 8.5
    GHSA-pqg7-v6wh-3pfp

    TsDProxy: X-Forwarded-For header injection allows IP spoofing in proxied requests to backend services

    ## Description The HTTP reverse proxy handler in tsdproxy does not strip the X-Forwarded-For (or X-Real-IP) header from incoming requests before calling r.SetXForwarded(). This allows an authenticated Tailscale user to inject arbitrary X-Forwarded-For values …

    github.com/almeidapaulopt/tsdproxy Go
  • Critical 9.0
    GHSA-g936-7jqj-mwv8

    TSDProxy: Internal proxy auth token forwarded to backend services enables management API escalation

    ## Description A vulnerability was discovered in TSDProxy where it forwards its internal per-process authentication token to all proxied backend services. When `identityHeaders` is enabled (the default), tsdproxy injects `x-tsdproxy-auth-token` into every ups…

    github.com/almeidapaulopt/tsdproxy Go