Vulnerability · Published May 19, 2026 · Assigned by VulnCheck

CVE-2026-43634HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

High 7.5

In plain English

A high-severity security flaw in hestiacp from hestiacp. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.2%top 84.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.

Affected products (as reported)

Vendor	Product	Versions
hestiacp	hestiacp	1.2.0 – through 1.9.4

Weakness: CWE-348 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634 technical-description, exploit
https://github.com/hestiacp/hestiacp/issues/5229 issue-tracking
https://github.com/hestiacp/hestiacp/pull/5273 issue-tracking
https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88 patch
https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header third-party-advisory