Is CVE-2026-113507 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113507 being exploited in the wild.

How severe is CVE-2026-113507?

Medium severity, with a CVSS score of 5.3, published 20 October 2026.

How is CVE-2026-113507 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-113507?

Check whether you run aaPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113507: aaPanel IP allowlist and brute-force protection bypass via X-Real-Ip spoofing

CVE-2026-113507 · Severity: medium · CVSS 5.3 · Published 2026-10-20

aaPanel is a web server control panel used to manage hosting and server configurations. An attacker can spoof their IP address by manipulating the X-Real-Ip HTTP header, allowing them to bypass IP allowlist restrictions and login rate-limiting protections. This enables unauthorized access attempts and credential brute-forcing without authentication.

Technologies: aaPanel. Vendors: aaPanel.

Quick answers

Is CVE-2026-113507 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113507 being exploited in the wild.
How severe is CVE-2026-113507?: Medium severity, with a CVSS score of 5.3, published 20 October 2026.
Which products and versions are affected?: aaPanel up to 8.25.0.
Is there a fix for CVE-2026-113507?: Yes: fixed in The vendor confirms the X-Real-Ip IP-bypass vulnerability has been fixed, but no specific version number is stated.. Until then: Only trust X-Real-Ip / X-Forwarded-For / CF-Connecting-IP headers when CDN_PROXY is enabled and the direct socket peer is configured as a trusted proxy; otherwise use the raw WSGI REMOTE_ADDR. Key all abuse-rate limits on the real peer socket address instead of the spoofable header value. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113507 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-113507?: Check whether you run aaPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: The vendor confirms the X-Real-Ip IP-bypass vulnerability has been fixed, but no specific version number is stated.

Only trust X-Real-Ip / X-Forwarded-For / CF-Connecting-IP headers when CDN_PROXY is enabled and the direct socket peer is configured as a trusted proxy; otherwise use the raw WSGI REMOTE_ADDR. Key all abuse-rate limits on the real peer socket address instead of the spoofable header value.

Technical details

The vulnerability exists in the before_request hook (BTPanel/__init__.py) which trusts the client-supplied X-Real-Ip header and directly overwrites request.remote_addr without validating that the peer is a trusted reverse proxy. This spoofable value is then used by downstream security checks: the IP allowlist (check_ip_panel) bypasses access restrictions, and rate-limit counters (limit_address, API-key limit) can be reset by rotating the header value, enabling unlimited brute-force attempts. The attack requires no authentication and can be performed remotely.

Affected products

aaPanel aaPanel up to 8.25.0

Timeline

2026-09-23: disclosed: Vendor notified
2026-10-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.