Is CVE-2026-43634 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-43634 being exploited in the wild.

How severe is CVE-2026-43634?

High severity, with a CVSS score of 7.5, published 19 May 2026.

Which products and versions are affected?

HestiaCP Hestia Control Panel 1.2.0 through 1.9.4.

Is there a fix for CVE-2026-43634?

A patch was published on 2026-03-24: Fix merged into main branch via Pull Request #5273. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-43634 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-43634?

Check whether you run HestiaCP Hestia Control Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-43634: HestiaCP IP spoofing via CF-Connecting-IP header

CVE-2026-43634 · Severity: high · CVSS 7.5 · Published 2026-05-19

HestiaCP, an open-source control panel for managing web servers, contains a security flaw that allows attackers to hide their true identity. By sending a specially crafted web request, an attacker can trick the system into believing they are connecting from a different, trusted location. This allows them to bypass security blocks like brute-force protection, evade IP-based access restrictions, and manipulate security logs to hide their activity.

Technologies: HestiaCP Hestia Control Panel. Vendors: HestiaCP.

Quick answers

Is CVE-2026-43634 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-43634 being exploited in the wild.
How severe is CVE-2026-43634?: High severity, with a CVSS score of 7.5, published 19 May 2026.
Which products and versions are affected?: HestiaCP Hestia Control Panel 1.2.0 through 1.9.4.
Is there a fix for CVE-2026-43634?: A patch was published on 2026-03-24: Fix merged into main branch via Pull Request #5273. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-43634 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-43634?: Check whether you run HestiaCP Hestia Control Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

HestiaCP's login handler and session tracking components trust the 'CF-Connecting-IP' HTTP header without verifying that the request actually originated from Cloudflare's network. The software only performs a basic syntax check on the header value using 'FILTER_VALIDATE_IP'. Because the Nginx configuration passes all client headers to the PHP-FPM backend, an unauthenticated remote attacker connecting directly to the control panel (typically on port 8083) can provide any IP address. This can be used to circumvent fail2ban brute-force protections, bypass per-user IP allowlists, and poison authentication audit logs. The issue is addressed in the main branch by centralizing IP detection and validating that the peer IP belongs to a known Cloudflare range before honoring the header.

Affected products

HestiaCP Hestia Control Panel (HestiaCP) 1.2.0 through 1.9.4

Timeline

2026-01-16: disclosed: Initial notification sent to vendor.
2026-03-24: patched: Fix merged into main branch via Pull Request #5273.
2026-05-19: advisory: Public disclosure by Mercury ISS.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.