GCVE-110-VULN-PYPI-2026-000632

If you run an oracle built on aimarket-oracle-core 0.2.0 through 0.6.0 where callers can reach its port without going through your reverse proxy, any of them can reset its rate limit with every request and, when you list the hub in ORACLE_TRUSTED_PAYMENT_PROXIES (from 0.3.0), claim the paid tier without paying. The rate-limit key and the paid-tier check (tiers.PaidTierPolicy.is_paid) both use app.client_key, which is X-Real-IP, or an X-Forwarded-For entry, from whichever peer sent the request, so sending X-Real-IP with the hub's address and an X-Payment-Channel header is served as the paying hub. A listed loopback address also admitted every caller relayed by an nginx on the same host, which sends no X-Real-IP by default. Fixed in 0.6.2 (0.6.1 was not published to PyPI) for callers on public networks: the headers count only when the TCP peer is a loopback, private or link-local address, and a loopback address never counts as a payment proxy. A caller on a private network the oracle shares with others is still trusted (GCVE-110-VULN-PYPI-2026-000637). ORACLE_PAID_TIER_SECRET is not affected. Affects 0.2.0 through 0.6.0.