CVE-2026-27700: Critical IP Spoofing Flaw in Eclipse Hono Enables Authentication Bypass Behind AWS ALB

CVE-2026-27700 — Authentication Bypass via IP Spoofing in Hono AWS Lambda Adapter

CVE: CVE-2026-27700
Severity: High
CVSS v3.1 (Base Score): 8.2
Affected Software: Hono web framework (npm hono) versions 4.12.0 and 4.12.1
Patched Version: 4.12.2

Official patch / upgrade link:
🔗 https://www.npmjs.com/package/hono

Overview

This vulnerability exists in the way Hono’s AWS Lambda adapter (hono/aws-lambda) determines the client’s IP address when the application is deployed behind an AWS Application Load Balancer (ALB). A feature intended to help applications read the real client IP instead ends up trusting data that can be controlled by a remote attacker.

When an ALB forwards a request, it adds the original client’s IP to the end of the X-Forwarded-For header. The Hono code erroneously used the first value in this header as the client’s IP. Because an attacker can send their own X-Forwarded-For header, they could insert a spoofed IP at the start and trick the application into believing the request came from a trusted source, thereby bypassing any access controls based on IP allowlists.

This issue only affects deployments behind an ALB that rely on IP-based restrictions. Other invocation models such as API Gateway or Lambda Function URLs were not affected.

Technical Description

An ALB will append the real source IP to the end of the X-Forwarded-For header. A client-supplied X-Forwarded-For header might look like:

X-Forwarded-For: 203.0.113.45

ALB forwards it as:

X-Forwarded-For: 203.0.113.45, 198.51.100.19

Where 198.51.100.19 is the real client IP.

Hono’s previous implementation took the leftmost value (203.0.113.45) and treated it as the client’s IP. That leftmost value could easily be spoofed by an unauthenticated attacker because headers are supplied by the HTTP client.

Critical authorization logic that uses this IP — for example the ipRestriction() middleware or custom logic checking getConnInfo(c).remote.address — would therefore allow the request if the spoofed IP met its allowlist criteria, even though the real client did not.

The patch corrects this behavior so that the ALB-appended (last) IP in the list is used, or otherwise ensures the client IP is taken from a trusted, provider-controlled field.

Exploit Mechanics

To exploit this, an attacker needs only to send an HTTP request to a Hono-based service running behind an ALB with a crafted X-Forwarded-For header. No authentication, privileges, or special interaction is required.

Example Exploit Walkthrough

Identify a Hono service deployed behind an ALB that uses IP-based access controls.
Craft an HTTP request with a custom X-Forwarded-For header such as: X-Forwarded-For: 203.0.113.99
Send the request to the service.
Because the ALB appends the real client IP after the attacker’s value, and Hono previously trusted the first value, the application believes the request comes from the spoofed IP.

This results in unauthorized access to endpoints that might otherwise reject the connection.

There are no known widely published proof-of-concept (PoC) scripts as of now, but the mechanics are simple and readily verifiable with basic HTTP tools.

Impact

Successful exploitation results in bypass of IP-based access controls. An attacker could access services or operations intended only for specific networks or systems. Because this flaw does not require authentication and is network-accessible, it carries high severity.

Detection Techniques

Because there is no formal exploit kit involved, detection focuses on identifying abnormal header usage and mismatches between what the application believes is the client IP and what infrastructure logs record.

Log Sources You Should Monitor

ALB Access Logs
These logs record both the real client IP and the full X-Forwarded-For header as seen at the load balancer.
Application Logs (CloudWatch or other)
Logs from the Lambda function or framework that show what IP the application believes the request came from.
WAF / Firewall Logs
If a Web Application Firewall is in place, inspect any rules or alerts involving the X-Forwarded-For header.

Detection Rules and Queries

Here are practical checks that can help you spot exploitation attempts or misconfigurations.

1. Detect Unusual Leftmost IP in Headers

If your logging includes the full X-Forwarded-For header and the effective client IP the application used:

Filter where (Leftmost IP from X-Forwarded-For) != (App’s observed client IP)
AND Leftmost IP is in a trusted range

This suggests someone supplied a false trusted IP.

2. Compare ALB’s True Client IP to Application-Used IP

In logs:

SELECT ALB_client_ip, app_trusted_ip, x_forwarded_for
FROM alb_access_logs
WHERE app_trusted_ip != last_ip_in_x_forwarded_for

Where app_trusted_ip is the IP your application logged as the client.

A mismatch could indicate exploitation or misconfigured trust.

3. Simple Header Pattern Check

Look for requests where:

X-Forwarded-For contains multiple values
The first value does not match the actual source IP seen by ALB

This often happens when an attacking client inserts a spoofed IP.

Indicators of Compromise (IoC)

While there are no binary signatures, the following patterns have high signal:

Multiple requests with X-Forwarded-For where the first IP is in an allowlist but the ALB-recorded client IP does not match.
Requests accepted by IP-restricted endpoints where ALB logs indicate real client IPs outside allowed ranges.
Sudden access from clients that bypass expected IP rules when you start logging both the header and ALB’s client IP.

Defense and Mitigation

Upgrade Immediately to Hono 4.12.2 or later using the official package link above. This fixes the root cause by correctly choosing the appropriate IP address from the header.
If you cannot yet upgrade, configure your ALB to remove or overwrite client-supplied X-Forwarded-For headers before forwarding to the Lambda. This ensures only trusted IPs make it into that header.
Implement strict WAF rules to block or sanitize suspicious X-Forwarded-For values.
Instrument your logs to always record both what the load balancer sees as the source IP and what the application believes is the client IP for comparison.

Summary of Weakness

This issue stems from bad trust in unvalidated header data. IP allowlists and similar logic are only as reliable as the data they use — and when that data can be controlled by an attacker, the access control breaks.

Detection with Common Tools

Although you asked to avoid Sigma, you can still implement similar logic in your SIEM or log analysis pipelines. For example, in structured logging engines:

if x_forwarded_for contains “,” 
    and first_ip != last_ip
    and first_ip is in allowlist
then alert “Possible header spoofing against IP restrictions”

This will catch attempts where spoofed IPs disguise as trusted before the real client IP.