Skip to content
Threat Feed

Vendor

HestiaCP

2 briefs RSS
high advisory

HestiaCP IP Spoofing Vulnerability (CVE-2026-43634)

HestiaCP versions 1.2.0 through 1.9.4 are vulnerable to IP spoofing (CVE-2026-43634), allowing unauthenticated remote attackers to bypass authentication security controls by manipulating the CF-Connecting-IP HTTP header to circumvent fail2ban, bypass IP allowlists, and poison authentication logs.

HestiaCP ip-spoofing authentication-bypass cve
2r 1t 1c
critical threat

HestiaCP Deserialization Vulnerability (CVE-2026-43633)

HestiaCP versions 1.9.0 through 1.9.4 are vulnerable to unauthenticated remote code execution due to a deserialization flaw in the web terminal component (CVE-2026-43633), stemming from a session format mismatch between PHP and Node.js, allowing attackers to inject malicious data via HTTP headers.

HestiaCP 1.9.0 +4 deserialization rce cve
2r 1t 1c