---
id: "CVE-2026-18516"
kind: "vulnerability"
aliases: ["CVE-2026-18516"]
title: "An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated\u2026"
severity: "critical"
cvss: 9.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Crafty Controller", "fixed": ["4.11.0"], "affected": "<= 4.10.8", "ecosystem": "other"}]
ecosystems: []
tags: ["crafty-controller", "minecraft", "other", "self-hosted", "xss"]
not_affected_if: ["not-crafty-controller", "version-4.11.0-or-later"]
published_at: "2026-10-16T14:17:24+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:33:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18516", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:33:12+00:00"}]
---

# An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated…

Crafty Controller trusts client-supplied X-Real-IP / X-Forwarded-For as the remote IP. A failed login for an existing username stores that value in the activity (audit) log, and the Activity Logs page inserts it into the DOM as HTML. An unauthenticated attacker gets stored XSS that runs when a superuser opens the page. The project's own report chains it to a full-access API key, a changed server start command and command execution as the OS user running Crafty. The victim must be a superuser who opens Activity Logs.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Crafty Controller affected <= 4.10.8 fixed 4.11.0

## How to check

Check the Crafty version (shown in the panel footer or config). Anything at or below 4.10.8 is affected. Exposed if the panel is reachable by untrusted networks, especially without a reverse proxy that overwrites X-Real-IP and X-Forwarded-For. Look at Activity Logs for failed-login entries whose IP field contains HTML or script (e.g. '<').

## Fix

Upgrade to Crafty Controller 4.11.0 or later (released 2026-09-16). Workaround from the CVE record: put Crafty behind a reverse proxy that blocks or overwrites client-supplied X-Real-IP and X-Forwarded-For, and restrict panel access to trusted networks. If you suspect exposure, review API keys and server start commands for unexpected changes.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-18516
- 2026-10-23T23:33:12+00:00 analyst — Read the project's GitLab issue #743 (report, confirmed on 4.10.7) and the 4.11.0 changelog, which names this CVE. The affected range 'through 4.10.8' comes from secnews.gr and AcidPeak, which cite NVD/CNA, not from a vendor page. No in-the-wild exploitation and no public PoC beyond the issue write-up. Skipped X search.

## Documents

- [advisory] Pre-auth stored XSS in Activity Logs can lead to command execution (#743) https://gitlab.com/crafty-controller/crafty-4/-/work_items/743
- [fix] Crafty 4 changelog, 4.11.0 https://gitlab.com/crafty-controller/crafty-4/-/blob/master/CHANGELOG.md
- [mitigation] AcidPeak: CVE-2026-18516 (quotes CVE record solution) https://www.acidpeak.com/threats/cve-2026-18516/

## From the sources

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_