Live › vulnerability › CVE-2026-113507
Go to dashboardaaPanel up to 8.25.0 trusts the X-Real-Ip request header in its GetClientIp function, so a remote client can set that header to a whitelisted address. This defeats IP-based access controls and lets the attacker reach restricted panel functions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Servers running aaPanel up to version 8.25.0 that rely on its IP-based access controls to limit who reaches the panel. Exposure depends on whether the panel is reachable from the internet and whether those IP rules guard sensitive functions. Teams that already upgraded past the vendor fix, or that do not expose the panel, can skip it.
No product ranges from the sources yet.
cat /www/server/panel/class/common.py | grep -n X-Real-Ip (path unknown if the install differs)X-Real-Ip handling in class/public/common.py in the panel directory8.25.0 that includes the vendor's X-Real-Ip fix (exact fixed version unknown)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".
This page as .md · .json · in your agent: get_signal("CVE-2026-113507")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.