{"id":"CVE-2026-43634","title":"HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header","summary":"HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header w…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-348"],"vendor":"hestiacp","product":"hestiacp","affected":["hestiacp >= 1.2.0 <= 1.9.4"],"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"partial","timestamp":"2026-05-19T16:39:12.742374Z"},"exploitAvailable":true,"published":"2026-05-19","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:03:28.605Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43634","references":[{"url":"https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634"},{"url":"https://github.com/hestiacp/hestiacp/issues/5229"},{"url":"https://github.com/hestiacp/hestiacp/pull/5273"},{"url":"https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88"},{"url":"https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header"}],"tags":["cve.org","exploit-available"],"epss":0.00241,"epssPercentile":0.15295,"ingestedAt":"2026-11-08T14:51:22.430Z","slug":"CVE-2026-43634","body":"## Overview\n\nHestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.\n\n## Affected\n\n- `hestiacp >= 1.2.0 <= 1.9.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}