CVE-2026-43634
Published: 19 May 2026
Summary
CVE-2026-43634 is a high-severity Use of Less Trusted Source (CWE-348) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Prevents use of less-trusted or adversarial sources by requiring proof of origin and integrity before accepting responses.
NVD Description
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP HTTP header without verifying the request originated from Cloudflare's network. Attackers…
more
can exploit this to circumvent fail2ban brute-force protection, bypass per-user IP allowlists, and poison authentication audit logs by spoofing trusted IP addresses on each request.
Deeper analysisAI
Automated synthesis unavailable for this CVE.
Details
- CWE(s)