Is CVE-2026-108736 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108736?

CVE-2026-108736 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-108736

Description

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.