Read the docs
TI-2026-31738 Aliases CVE-2026-43634GHSA-72fg-f46j-5gvp

HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header

Priority HIGH 77CWE-348Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00241 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hestiacphestiacp1.2.0 – 1.9.4—Patch availableCNA
  • hestiacp Vendorhestiacp Affected 1.2.0 – 1.9.4 Fixed in — Patch available CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43634
  2. 2026-10-03 Alias added: GHSA-72fg-f46j-5gvp

References

Exploit 1

Patch 2

Other 1

  • TI-2026-31737 HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal CVSS 4.0CRITICAL 9.5
  • TI-2026-74366 PATH hijacking in HestiaCP lets low-privileged users run code as root CVSS 3.1CRITICAL 9.9
  • TI-2026-75413 HestiaCP Protected Admin Bypass via Cron Job Creation CVSS 4.0HIGH 8.6
  • TI-2026-10488 HestiaCP Admin Takeover CVSS 4.0HIGH 8.3
  • TI-2023-05375 Privilege Chaining in hestiacp/hestiacp CVSS 3.1HIGH 7.8
  • TI-2022-02355 OS Command Injection in hestiacp/hestiacp CVSS 3.1HIGH 8.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences