Description
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Published: 2026-10-20
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Access Control Bypass
Action: Patch Now
AI Analysis

Impact

Within aaPanel up to 8.25.0, the GetClientIp function in class/public/common.py improperly uses the X-Real-Ip request header to determine client identity. By manipulating this header, an attacker can bypass the normal authentication and access‑control checks – a flaw that falls under CWE-284 (Improper Access Control) and can also allow privilege escalation via CWE-266 (Insufficient Privilege Separation). This remote header manipulation lets an adversary impersonate other users or gain elevated privileges, potentially accessing sensitive data or administration functions without authorization.

Affected Systems

The affected product is aaPanel, a web hosting control panel. All releases up to and including 8.25.0 are vulnerable. Users running any of these versions should verify their installation and apply the fix.

Risk and Exploitability

The CVSS base score is 6.9, indicating a moderate risk. No EPSS score is available, but the vulnerability has a public exploit and the vendor confirms a fix has been released. The flaw can be triggered remotely via crafted HTTP requests. The KEV status shows it is not yet listed in CISA’s catalog, yet the public nature of the exploit warrants immediate attention.

Generated by OpenCVE AI on October 20, 2026 at 19:13 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor's patch or upgrade to any released version newer than 8.25.0.
  • Disable or sanitize the X-Real-Ip header in your reverse proxy or load balancer so that aaPanel does not rely on it for client IP determination.
  • Enforce strict validation of client IPs or restrict IP‑based access controls to trusted sources.
  • Monitor incoming requests for abnormal X-Real-Ip header values and log suspicious activity.

Generated by OpenCVE AI on October 20, 2026 at 19:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
Title aaPanel common.py GetClientIp access control
First Time appeared Aapanel
Aapanel aapanel
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:aapanel:aapanel:*:*:*:*:*:*:*:*
Vendors & Products Aapanel
Aapanel aapanel
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Aapanel Aapanel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-23T01:57:09.895Z

Reserved: 2026-10-20T10:53:30.529Z

Link: CVE-2026-113507

cve-icon Vulnrichment

Updated: 2026-10-23T01:57:05.967Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T18:17:18.810

Modified: 2026-10-23T02:16:55.160

Link: CVE-2026-113507

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T20:29:28Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control