HestiaCP IP Spoofing Vulnerability Bypasses Auth Controls

The National Vulnerability Database has detailed CVE-2026-43634, a high-severity IP spoofing vulnerability impacting HestiaCP versions 1.2.0 through 1.9.4. This flaw allows unauthenticated remote attackers to bypass critical authentication security controls. The core issue lies in HestiaCP’s failure to properly validate the CF-Connecting-IP HTTP header, allowing an attacker to supply an arbitrary IP address without verifying the request originates from Cloudflare’s trusted network.

Attackers can leverage this vulnerability to circumvent fail2ban brute-force protections, bypass per-user IP allowlists, and poison authentication audit logs. By spoofing trusted IP addresses on each request, they can mask their true origin and make it significantly harder for defenders to detect and respond to malicious activity. The CVSSv3.1 score is 7.5 (HIGH), reflecting the significant impact on integrity without requiring authentication.

This isn’t just a theoretical bypass; it’s a fundamental breakdown of trust. When an attacker can dictate the source IP, all IP-based security mechanisms become moot. Defenders relying on fail2ban or IP allowlists for HestiaCP instances are essentially operating without those controls if this vulnerability isn’t addressed.