CVE-2026-43634

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43634", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-05-01T18:22:45.641Z", "datePublished": "2026-05-19T13:33:08.825Z", "dateUpdated": "2026-11-08T14:03:28.605Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:03:28.605Z"}, "datePublic": "2026-03-09T00:00:00.000Z", "title": "HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header", "descriptions": [{"lang": "en", "value": "HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-348", "description": "Use of Less Trusted Source", "type": "CWE"}]}], "affected": [{"vendor": "hestiacp", "product": "hestiacp", "repo": "https://github.com/hestiacp/hestiacp", "versions": [{"status": "affected", "version": "1.2.0", "lessThanOrEqual": "1.9.4", "versionType": "semver"}, {"status": "unaffected", "version": "f381e294500f671cf12716c638afd0bfde901f88", "versionType": "git"}], "defaultStatus": "affected", "packageURL": "pkg:github/hestiacp/hestiacp"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}}], "references": [{"url": "https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/hestiacp/hestiacp/issues/5229", "tags": ["issue-tracking"]}, {"url": "https://github.com/hestiacp/hestiacp/pull/5273", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "sutol", "type": "finder"}, {"lang": "en", "value": "divinity76", "type": "remediation developer"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T16:39:12.742374Z", "id": "CVE-2026-43634", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T16:39:31.444Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43634", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T16:39:12.742374Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T16:39:27.735Z"}}], "cna": {"tags": ["x_open-source"], "title": "HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "sutol"}, {"lang": "en", "type": "remediation developer", "value": "divinity76"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hestiacp/hestiacp", "vendor": "hestiacp", "product": "hestiacp", "versions": [{"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.9.4"}, {"status": "unaffected", "version": "f381e294500f671cf12716c638afd0bfde901f88", "versionType": "git"}], "packageURL": "pkg:github/hestiacp/hestiacp", "defaultStatus": "affected"}], "datePublic": "2026-03-09T00:00:00.000Z", "references": [{"url": "https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634", "tags": ["technical-description", "exploit"]}, {"url": "https://github.com/hestiacp/hestiacp/issues/5229", "tags": ["issue-tracking"]}, {"url": "https://github.com/hestiacp/hestiacp/pull/5273", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-348", "description": "Use of Less Trusted Source"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:03:28.605Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43634", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:03:28.605Z", "dateReserved": "2026-05-01T18:22:45.641Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-05-19T13:33:08.825Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:github/hestiacp/hestiacp", "product": "hestiacp", "repo": "https://github.com/hestiacp/hestiacp", "vendor": "hestiacp", "versions": [{"lessThanOrEqual": "1.9.4", "status": "affected", "version": "1.2.0", "versionType": "semver"}, {"status": "unaffected", "version": "f381e294500f671cf12716c638afd0bfde901f88", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request."}, {"lang": "es", "value": "Las versiones de HestiaCP 1.2.0 a 1.9.4 contienen una vulnerabilidad de suplantaci\u00f3n de IP que permite a atacantes remotos no autenticados eludir los controles de seguridad de autenticaci\u00f3n al proporcionar una direcci\u00f3n IP arbitraria en el encabezado HTTP CF-Connecting-IP sin verificar que la solicitud se origin\u00f3 en la red de Cloudflare. Los atacantes pueden explotar esto para eludir la protecci\u00f3n contra fuerza bruta de fail2ban, eludir las listas de permitidos de IP por usuario, y envenenar los registros de auditor\u00eda de autenticaci\u00f3n al suplantar direcciones IP confiables en cada solicitud."}], "id": "CVE-2026-43634", "lastModified": "2026-07-24T12:10:00.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43634", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T16:39:12.742374Z", "version": "2.0.3"}}]}, "published": "2026-05-19T15:16:31.023", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/hestiacp/hestiacp/commit/f381e294500f671cf12716c638afd0bfde901f88"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hestiacp/hestiacp/issues/5229"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hestiacp/hestiacp/pull/5273"}, {"source": "disclosure@vulncheck.com", "url": "https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/hestiacp-ip-spoofing-via-cf-connecting-ip-header"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-348"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.2.0,1.9.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "f381e294500f671cf12716c638afd0bfde901f88"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "hestiacp", "source": "cna", "vendor": "hestiacp"}, "product": "hestiacp", "vendor": "hestiacp"}], "created": "2026-05-19T15:30:08.162065+00:00", "updated": "2026-05-19T15:30:08.493349+00:00", "vendors": ["hestiacp", "hestiacp$PRODUCT$hestiacp"]}