In api-gateway versions till 1.7.3, The default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.