CVE-2026-43634
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
- State
- Published
- Severity
- 8.7 High
- Published
- May 19, 2026
- Updated
- Jul 14, 2026
- Reserved
- May 1, 2026
Description
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-348 Use of Less Trusted Source
Affected Products
| Product | Versions |
|---|---|
hestiacphestiacp |
|
References
- https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634technical-descriptionexploit
- https://github.com/hestiacp/hestiacp/issues/5229issue-tracking
- https://github.com/hestiacp/hestiacp/pull/5273issue-tracking
- https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88patch
- https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-headerthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.