CVE-2026-58488: HedgeDoc Auth Bypass Vulnerability

CVE-2026-58488 Overview

CVE-2026-58488 is an authentication-related vulnerability in HedgeDoc, an open source real-time collaborative markdown notes application. Versions prior to 1.11.0 trust the cf-connecting-ip header regardless of whether the request originates from Cloudflare. Attackers exploit this trust to spoof source IP addresses and bypass the rate limits enforced on the /login and /register routes. The flaw is categorized under CWE-290: Authentication Bypass by Spoofing. The issue is resolved in HedgeDoc version 1.11.0.

Critical Impact
Attackers can bypass rate limiting to brute-force login credentials or register unlimited arbitrary accounts by rotating spoofed IP headers.

Affected Products

HedgeDoc versions prior to 1.11.0
Self-hosted HedgeDoc instances exposed to the internet
HedgeDoc deployments not fronted by Cloudflare that still honor cf-connecting-ip

Discovery Timeline

2026-07-13 - CVE-2026-58488 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-58488

Vulnerability Analysis

HedgeDoc applies rate limiting to the /login and /register endpoints to slow brute-force attacks and prevent bulk account creation. The rate-limit key is derived from the client IP address. To support deployments behind Cloudflare, HedgeDoc reads the cf-connecting-ip request header and uses its value as the effective source IP when present.

The implementation does not validate that the request actually traversed Cloudflare's edge network. Any client can send an arbitrary cf-connecting-ip header directly to the HedgeDoc server. The application accepts the spoofed value and applies rate limits against attacker-controlled IPs instead of the real source.

An attacker rotates the header value every few requests to distribute counters across many synthetic IPs. This effectively removes the rate limit entirely. The attacker can then submit high-volume credential guesses against /login or automate arbitrary account creation through /register.

Root Cause

The root cause is unconditional trust in a client-supplied header. HedgeDoc should only honor cf-connecting-ip when the connecting peer is a known Cloudflare edge address. Missing peer validation converts a convenience header into an authentication-bypass primitive [CWE-290].

Attack Vector

Exploitation requires only network access to the HedgeDoc HTTP endpoint. No authentication, user interaction, or elevated privileges are needed. The attacker sends standard HTTP POST requests to /login or /register with a rotating cf-connecting-ip header value. See the HedgeDoc GitHub Security Advisory for the vendor description.

Detection Methods for CVE-2026-58488

Indicators of Compromise

High volumes of requests to /login or /register carrying a cf-connecting-ip header value that changes rapidly across sessions
Failed authentication events distributed across many unique IPs but sharing the same TCP source address at the network layer
Sudden growth in registered user accounts with sequential or randomized usernames and unused profiles

Detection Strategies

Log the real TCP peer address alongside any header-derived IP and alert when the two diverge on inbound requests not originating from Cloudflare ranges
Correlate /login failure rates against the true socket-level source IP rather than the header-derived value
Compare account-creation velocity against historical baselines to surface bulk registration activity

Monitoring Recommendations

Enable verbose access logging on the HedgeDoc reverse proxy to capture both X-Forwarded-For and cf-connecting-ip values for every request
Ingest HedgeDoc application logs into a centralized analytics platform and build queries that group authentication attempts by TCP peer
Monitor egress patterns from newly created accounts for signs of spam, phishing content, or note enumeration

How to Mitigate CVE-2026-58488

Immediate Actions Required

Upgrade HedgeDoc to version 1.11.0 or later
If Cloudflare is not in the request path, strip the cf-connecting-ip header at the reverse proxy before it reaches HedgeDoc
Audit recent registrations and authentication logs for evidence of brute-force or bulk account creation

Patch Information

The HedgeDoc maintainers fixed the vulnerability in version 1.11.0. The patched release corrects how HedgeDoc derives the client IP so that the cf-connecting-ip header is no longer trusted from arbitrary sources. Full details are available in the HedgeDoc GitHub Security Advisory GHSA-2f9f-w8xq-276v.

Workarounds

Configure the fronting reverse proxy (nginx, Traefik, Caddy) to unset or overwrite the cf-connecting-ip header on all inbound requests when Cloudflare is not used
Restrict access to /login and /register behind an authenticated VPN or IP allowlist for private deployments
Enforce strong CAPTCHA or additional application-layer rate limiting keyed on TCP peer address

bash

# Example nginx configuration to strip spoofed Cloudflare header
# when the deployment does not sit behind Cloudflare
location / {
    proxy_set_header cf-connecting-ip "";
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_pass http://hedgedoc_backend;
}