PT-2026-41935 · Hestiacp · Hestiacp

Divinity76 + 1 · Published 2026-05-19 · Updated 2026-05-30 · CVE-2026-43634

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HestiaCP versions 1.2.0 through 1.9.4

Description An IP spoofing issue allows unauthenticated remote attackers to bypass authentication security controls. This occurs when the system accepts an arbitrary IP address provided in the 'CF-Connecting-IP' HTTP header without verifying that the request actually originated from the Cloudflare network. Exploitation enables attackers to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses.

Recommendations Update HestiaCP to a version later than 1.9.4. As a temporary mitigation, restrict access to the control panel or configure the server to only accept 'CF-Connecting-IP' headers from verified Cloudflare IP ranges.

Exploit

Fix

Weakness Enumeration

CWE-348

Related Identifiers

CVE-2026-43634

Affected Products

Hestiacp

References · 9

• 🔥 https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634 · Exploit
• https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43634 · Security Note
• https://github.com/hestiacp/hestiacp/pull/5273 · Note
• https://github.com/hestiacp/hestiacp/issues/5229 · Note
• https://twitter.com/CVEnew/status/2056870224582885800 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2056771064588337175 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2060517888893538307 · Twitter Post
• https://vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header · Note