# CVE-2026-113507: aaPanel IP allowlist and brute-force protection bypass via X-Real-Ip spoofing

Source: https://junglewise.ai/threats/cve-2026-113507-a-vulnerability-was-found-in-aapanel-up-to-8-25-0-the-impacted  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113507 · Severity: medium · CVSS 5.3 · Published 2026-10-20

aaPanel is a web server control panel used to manage hosting and server configurations. An attacker can spoof their IP address by manipulating the X-Real-Ip HTTP header, allowing them to bypass IP allowlist restrictions and login rate-limiting protections. This enables unauthorized access attempts and credential brute-forcing without authentication.

Technologies: [aaPanel](https://junglewise.ai/threats/technologies/aapanel). Vendors: [aaPanel](https://junglewise.ai/threats/vendors/aapanel).

## Quick answers

**Is CVE-2026-113507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113507 being exploited in the wild.

**How severe is CVE-2026-113507?** Medium severity, with a CVSS score of 5.3, published 20 October 2026.

**Which products and versions are affected?** aaPanel up to 8.25.0.

**Is there a fix for CVE-2026-113507?** Yes: fixed in The vendor confirms the X-Real-Ip IP-bypass vulnerability has been fixed, but no specific version number is stated.. Until then: Only trust X-Real-Ip / X-Forwarded-For / CF-Connecting-IP headers when CDN_PROXY is enabled and the direct socket peer is configured as a trusted proxy; otherwise use the raw WSGI REMOTE_ADDR. Key all abuse-rate limits on the real peer socket address instead of the spoofable header value. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113507 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-113507?** Check whether you run aaPanel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in The vendor confirms the X-Real-Ip IP-bypass vulnerability has been fixed, but no specific version number is stated.

Only trust X-Real-Ip / X-Forwarded-For / CF-Connecting-IP headers when CDN_PROXY is enabled and the direct socket peer is configured as a trusted proxy; otherwise use the raw WSGI REMOTE_ADDR. Key all abuse-rate limits on the real peer socket address instead of the spoofable header value.

## Technical details

The vulnerability exists in the before_request hook (BTPanel/__init__.py) which trusts the client-supplied X-Real-Ip header and directly overwrites request.remote_addr without validating that the peer is a trusted reverse proxy. This spoofable value is then used by downstream security checks: the IP allowlist (check_ip_panel) bypasses access restrictions, and rate-limit counters (limit_address, API-key limit) can be reset by rotating the header value, enabling unlimited brute-force attempts. The attack requires no authentication and can be performed remotely.

## Affected products

- aaPanel aaPanel up to 8.25.0

## Timeline

- 2026-09-23: disclosed: Vendor notified
- 2026-10-20: advisory

## References

- [https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip](https://github.com/JdExploit/aapanel-cve-2026/tree/master/aapanel-xrealip)
- [https://vuldb.com/cve/CVE-2026-113507](https://vuldb.com/cve/CVE-2026-113507)

## Related threats

- [aaPanel OS command injection in File Manager](https://junglewise.ai/threats/cve-2026-113506-a-vulnerability-has-been-found-in-aapanel-up-to-8-25-0-the)
- [aaPanel path traversal in download endpoint](https://junglewise.ai/threats/cve-2026-113505-a-flaw-has-been-found-in-aapanel-up-to-8-25-0-impacted-is-the)