Pain point · Permissions & security · Causes churn
Untrusted client-IP headers can bypass the IP allowlist
1 source thread · first seen 2026-10
Summary
When proxy_client_headers is configured, Matomo may trust a client-supplied IP header without verifying that the connecting peer is a trusted proxy. An attacker can spoof an allowlisted IP to pass the IP gate, although normal credentials are still required for protected data.
- Affects
- Matomo administrators using proxy_client_headers and LoginAllowlist
- Workaround
- Only expose Matomo through a proxy that overwrites or removes client-supplied forwarding headers; the report also calls for trusting headers only from verified proxies.
Evidence
Excerpts are copied word for word from the source; follow the link to read it in full.
“a client can therefore choose the IP used by `LoginAllowlist`”