GCVE-110-VULN-PYPI-2026-000637

If you run an oracle built on aimarket-oracle-core where hosts or containers you do not control share a private network with it, any of them can reset its rate limit with every request and, when you list the hub in ORACLE_TRUSTED_PAYMENT_PROXIES, claim the paid tier without paying. The rate-limit key and the paid-tier check (tiers.PaidTierPolicy.is_paid) both use app.client_key, which is X-Real-IP, or the right-most X-Forwarded-For entry. 0.6.2 reads those headers only when the TCP peer is a loopback, private or link-local address (app.peer_is_local_proxy). A neighbour container on the same Docker network, which the 0.6.0 source itself names as a direct caller, is such a peer: it can send X-Real-IP with the hub's address and an X-Payment-Channel header and be served as the paying hub. In 0.2.0 through 0.6.0 a caller on any network could (GCVE-110-VULN-PYPI-2026-000632). ORACLE_PAID_TIER_SECRET is not affected. No release limits header trust to your proxy. Affects 0.2.0 through 0.6.2.