Junglewise Threat Intelligence

CVE-2026-43634: HestiaCP IP spoofing via CF-Connecting-IP header

CVE-2026-43634 · Severity: high · CVSS 7.5 · Published 2026-05-19

Vendors: HestiaCP.

Executive brief

HestiaCP, an open-source control panel for managing web servers, contains a security flaw that allows attackers to hide their true identity. By sending a specially crafted web request, an attacker can trick the system into believing they are connecting from a different, trusted location. This allows them to bypass security blocks like brute-force protection, evade IP-based access restrictions, and manipulate security logs to hide their activity.

Technical details

HestiaCP's login handler and session tracking components trust the 'CF-Connecting-IP' HTTP header without verifying that the request actually originated from Cloudflare's network. The software only performs a basic syntax check on the header value using 'FILTER_VALIDATE_IP'. Because the Nginx configuration passes all client headers to the PHP-FPM backend, an unauthenticated remote attacker connecting directly to the control panel (typically on port 8083) can provide any IP address. This can be used to circumvent fail2ban brute-force protections, bypass per-user IP allowlists, and poison authentication audit logs. The issue is addressed in the main branch by centralizing IP detection and validating that the peer IP belongs to a known Cloudflare range before honoring the header.

Affected products

  • HestiaCP Hestia Control Panel (HestiaCP) 1.2.0 through 1.9.4

Timeline

  • 2026-01-16: disclosed: Initial notification sent to vendor.
  • 2026-03-24: patched: Fix merged into main branch via Pull Request #5273.
  • 2026-05-19: advisory: Public disclosure by Mercury ISS.

References

Related threats