CVE-2026-43634
High
Description
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.
SeverityHigh
CVSS7.5
Exploit probability15. percentile0.2%
ProductHestiacp
PublishedMay 19, 2026
First seenMay 19, 2026
Weakness typeCWE-348CWE-348
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hestiacp hestiacp | 1.2.0 ≤ v ≤ 1.9.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.