# CVE-2026-43634: HestiaCP IP spoofing via CF-Connecting-IP header

Source: https://junglewise.ai/threats/cve-2026-43634-hestiacp-ip-spoofing-via-cf-connecting-ip-header  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-19. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2026-43634 · Severity: high · CVSS 7.5 · Published 2026-05-19

HestiaCP, an open-source control panel for managing web servers, contains a security flaw that allows attackers to hide their true identity. By sending a specially crafted web request, an attacker can trick the system into believing they are connecting from a different, trusted location. This allows them to bypass security blocks like brute-force protection, evade IP-based access restrictions, and manipulate security logs to hide their activity.

Technologies: [HestiaCP Hestia Control Panel](https://junglewise.ai/threats/technologies/hestia-control-panel). Vendors: [HestiaCP](https://junglewise.ai/threats/vendors/hestiacp).

## Quick answers

**Is CVE-2026-43634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43634 being exploited in the wild.

**How severe is CVE-2026-43634?** High severity, with a CVSS score of 7.5, published 19 May 2026.

**Which products and versions are affected?** HestiaCP Hestia Control Panel 1.2.0 through 1.9.4.

**Is there a fix for CVE-2026-43634?** A patch was published on 2026-03-24: Fix merged into main branch via Pull Request #5273. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-43634 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-43634?** Check whether you run HestiaCP Hestia Control Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HestiaCP's login handler and session tracking components trust the 'CF-Connecting-IP' HTTP header without verifying that the request actually originated from Cloudflare's network. The software only performs a basic syntax check on the header value using 'FILTER_VALIDATE_IP'. Because the Nginx configuration passes all client headers to the PHP-FPM backend, an unauthenticated remote attacker connecting directly to the control panel (typically on port 8083) can provide any IP address. This can be used to circumvent fail2ban brute-force protections, bypass per-user IP allowlists, and poison authentication audit logs. The issue is addressed in the main branch by centralizing IP detection and validating that the peer IP belongs to a known Cloudflare range before honoring the header.

## Affected products

- HestiaCP Hestia Control Panel (HestiaCP) 1.2.0 through 1.9.4

## Timeline

- 2026-01-16: disclosed: Initial notification sent to vendor.
- 2026-03-24: patched: Fix merged into main branch via Pull Request #5273.
- 2026-05-19: advisory: Public disclosure by Mercury ISS.

## References

- [https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88](https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88)
- [https://github.com/hestiacp/hestiacp/issues/5229](https://github.com/hestiacp/hestiacp/issues/5229)
- [https://github.com/hestiacp/hestiacp/pull/5273](https://github.com/hestiacp/hestiacp/pull/5273)
- [https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634](https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634)
- [https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header](https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header)

## Related threats

- [Hestia Control Panel privilege escalation in custom document-root handling](https://junglewise.ai/threats/cve-2026-108390-hestia-control-panel-is-a-lightweight-and-powerful-control-panel)
- [HestiaCP deserialization in web terminal component](https://junglewise.ai/threats/cve-2026-43633-hestiacp-deserialization-in-web-terminal-component)