GCVE-110-VULN-PYPI-2026-000638

If you run aimarket-logos where hosts or containers you do not control share a private network with it, any of them can reset its rate limit with every request and spend your model budget through the language-model backed POST /api/v1/ask and /api/v1/chat routes past LOGOS_RATE_MAX. The logos entry point always binds 0.0.0.0 (logos.main), and the limit is keyed on X-Real-IP, or an X-Forwarded-For entry (app._client_key). 0.2.1 reads those headers only when the TCP peer is a loopback, private or link-local address (app._from_local_proxy). A neighbour on a private network is such a peer, so it still names its own key. In 0.1.0 and 0.2.0 a caller on any network could (GCVE-110-VULN-PYPI-2026-000633). No release limits header trust to your proxy. Affects 0.1.0 through 0.2.1.