{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-VULN-PYPI-2026-000637","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-10-27T22:42:51Z","dateUpdated":"2026-10-27T22:55:07Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"If you run an oracle built on aimarket-oracle-core where hosts or containers you do not control share a private network with it, any of them can reset its rate limit with every request and, when you list the hub in ORACLE_TRUSTED_PAYMENT_PROXIES, claim the paid tier without paying. The rate-limit key and the paid-tier check (tiers.PaidTierPolicy.is_paid) both use app.client_key, which is X-Real-IP, or the right-most X-Forwarded-For entry. 0.6.2 reads those headers only when the TCP peer is a loopback, private or link-local address (app.peer_is_local_proxy). A neighbour container on the same Docker network, which the 0.6.0 source itself names as a direct caller, is such a peer: it can send X-Real-IP with the hub's address and an X-Payment-Channel header and be served as the paying hub. In 0.2.0 through 0.6.0 a caller on any network could (GCVE-110-VULN-PYPI-2026-000632). ORACLE_PAID_TIER_SECRET is not affected. No release limits header trust to your proxy. Affects 0.2.0 through 0.6.2.","supportingMedia":null}],"references":[{"url":"https://pypi.org/project/aimarket-oracle-core/","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","baseScore":4.2,"baseSeverity":"MEDIUM"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Authentication Bypass by Spoofing","cweId":"CWE-290","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Use of Less Trusted Source","cweId":"CWE-348","type":"CWE"}]}],"affected":[{"vendor":"pypi","product":"aimarket-oracle-core","collectionURL":"https://pypi.org","packageName":"aimarket-oracle-core","repo":"","defaultStatus":"unknown","versions":[{"version":"0.2.0","status":"affected","versionType":"python","lessThan":"","lessThanOrEqual":"0.6.2","changes":null}],"cpes":null,"modules":["oracle_core.app","oracle_core.tiers"],"programFiles":["oracle_core/app.py","oracle_core/tiers.py"],"programRoutines":[{"name":"oracle_core.app.peer_is_local_proxy"},{"name":"oracle_core.app.client_key"},{"name":"oracle_core.tiers.PaidTierPolicy.is_paid"}],"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}