# CVE-2026-58488: HedgeDoc rate-limit bypass via CF-Connecting-IP spoofing

Source: https://junglewise.ai/threats/cve-2026-58488-hedgedoc-rate-limit-bypass-via-cf-connecting-ip-spoofing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-58488 · Severity: info · CVSS 6.9 · Published 2026-07-13

HedgeDoc is an open-source collaborative note-taking application. A security flaw allowed attackers to bypass rate-limiting protections on login and registration pages by spoofing their IP addresses. This could lead to automated brute-force attacks on user accounts or the creation of a large number of unauthorized accounts, potentially impacting service availability and security.

Technologies: [HedgeDoc](https://junglewise.ai/threats/technologies/hedgedoc). Vendors: [HedgeDoc](https://junglewise.ai/threats/vendors/hedgedoc).

## Quick answers

**Is CVE-2026-58488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58488 being exploited in the wild.

**How severe is CVE-2026-58488?** Informational severity, with a CVSS score of 6.9, published 13 July 2026.

**Which products and versions are affected?** HedgeDoc < 1.11.0.

**Is there a fix for CVE-2026-58488?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-58488 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58488?** Check whether you run HedgeDoc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

HedgeDoc versions prior to 1.11.0 incorrectly prioritized the 'cf-connecting-ip' HTTP header over the actual client IP address for rate-limiting purposes, even when requests did not originate from Cloudflare. An attacker can exploit this by providing arbitrary IP addresses in the header, effectively resetting the rate-limit counter for every few requests. This enables large-scale automated attacks such as credential stuffing or account registration spam. The vulnerability is addressed in version 1.11.0 by introducing a configuration toggle (CMD_RATE_LIMIT_USING_CLOUDFLARE) that disables header trust by default.

## Affected products

- HedgeDoc HedgeDoc < 1.11.0

## Timeline

- 2026-06-18: advisory: GitHub Security Advisory published
- 2026-07-13: disclosed: NVD publication date

## References

- [https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v](https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-2f9f-w8xq-276v)

## Related threats

- [HedgeDoc permission handler improper validation](https://junglewise.ai/threats/cve-2026-102927-hedgedoc-is-an-open-source-real-time-collaborative-markdown)
- [HedgeDoc CSRF in GitHub Gist export callback](https://junglewise.ai/threats/cve-2026-58489-hedgedoc-csrf-in-github-gist-export-callback)
- [HedgeDoc denial of service via YAML alias bomb in note frontmatter](https://junglewise.ai/threats/cve-2026-58486-hedgedoc-denial-of-service-via-yaml-alias-bomb-in-note)
- [HedgeDoc stored HTML injection via email local-part](https://junglewise.ai/threats/cve-2026-58487-hedgedoc-stored-html-injection-via-email-local-part)
- [HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's…](https://junglewise.ai/threats/cve-2025-66629-hedgedoc-is-an-open-source-real-time-collaborative-markdown-notes)