CVE-2026-43633 Details
Description
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled.
A deserialization vulnerability has been identified in HestiaCP versions 1.9.0 through 1.9.4, specifically within the web terminal component. This vulnerability arises from a session format mismatch between PHP and Node.js, allowing unauthenticated remote attackers to execute code with root privileges. Exploitation involves injecting crafted data into HTTP headers, which are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values. This misalignment enables arbitrary command execution on systems with the web terminal feature enabled.
Users are advised to disable the web terminal feature immediately and restrict access to the control panel's web interface port (8083) to trusted IP addresses. Both the web terminal vulnerability and the IP spoofing issue have been fixed in the main branch of the HestiaCP repository, but users will need to build from source to apply the patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hestiacp/hestiacp/commit/854d71b3c1737b0a0d0cc55c926008ffe1f6719b | [email protected] | Source CodeVendor |
| https://github.com/hestiacp/hestiacp/issues/5229 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/hestiacp/hestiacp/pull/5244 | [email protected] | Issue TrackingVendor |
| https://mercuryiss.com.au/hestiacp-unauthenticated-rce-ip-spoofing-cve-2026-43633-cve-2026-43634 | [email protected] | AdvisoryBundleRemedy |
| https://www.vulncheck.com/advisories/hestiacp-deserialization-rce-via-web-terminal | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| HestiaCP | >= 1.9.0, <= 1.9.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |