CVE-2026-84186: PrestaShop IP Spoofing Auth Bypass

CVE-2026-84186 Overview

CVE-2026-84186 is an incorrect access control vulnerability in the Tools::getRemoteAddr() function of PrestaShop. The function improperly parses the X-Forwarded-For HTTP header when the application runs behind a reverse proxy, load balancer, or content delivery network (CDN). An unauthenticated remote attacker can inject an arbitrary IP address into the header and cause the application to treat the request as originating from that address. This behavior enables bypass of IP-based controls such as the maintenance mode allowlist, forgery of security and audit log entries, and evasion of geolocation checks, fraud detection, and request throttling. The weakness is classified under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
Remote unauthenticated attackers can spoof arbitrary client IP addresses, bypassing allowlists, forging audit logs, and defeating fraud detection or geolocation controls that rely on the reported client address.

Affected Products

PrestaShop e-commerce platform deployments running behind a reverse proxy, load balancer, or CDN
Installations where Tools::getRemoteAddr() is used to enforce IP-based access controls
Environments relying on client IP data for audit logging, fraud detection, or request throttling

Discovery Timeline

2026-09-07 - CVE-2026-84186 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84186

Vulnerability Analysis

The vulnerability resides in the PrestaShop Tools::getRemoteAddr() function, which resolves the source IP address of an incoming HTTP request. When PrestaShop is deployed behind a trusted intermediary, the real client IP typically arrives inside the X-Forwarded-For header. The function is expected to consume only the address supplied by the trusted infrastructure and reject values under attacker control.

In the vulnerable implementation, PrestaShop parses the header incorrectly and selects an address that the visitor can freely control. As a result, the application binds application-layer decisions to a spoofable value rather than the trusted proxy-provided address.

Downstream impact spans multiple security controls. Attackers can defeat the maintenance mode allowlist and reach restricted storefronts. They can also inject arbitrary IP values into audit logs, undermining incident response. Third-party integrations that consume the recorded IP, including geolocation checks, fraud scoring, and rate limiting, receive falsified data and make incorrect trust decisions.

Root Cause

The root cause is improper trust boundary handling in the IP resolution logic. Tools::getRemoteAddr() treats attacker-controlled header contents as authoritative instead of restricting parsing to entries appended by the trusted proxy chain. This maps directly to CWE-290: Authentication Bypass by Spoofing.

Attack Vector

Exploitation requires only network access to the PrestaShop application. An attacker sends a standard HTTP request and supplies a crafted X-Forwarded-For header containing the desired spoofed IP address. No authentication and no user interaction are required. Because the attack rides on a normal request path, it leaves no unusual protocol artifacts, only the forged header value. Refer to the INCIBE Security Notice for additional technical detail.

Detection Methods for CVE-2026-84186

Indicators of Compromise

HTTP requests containing multiple or malformed X-Forwarded-For entries reaching the PrestaShop application layer
Audit or access log entries showing client IPs that do not match the immediate upstream proxy record
Successful access to maintenance mode or IP-restricted endpoints from addresses that were not on the operator allowlist
Sudden drops in fraud-detection or geolocation-based blocks without a corresponding rule change

Detection Strategies

Correlate the IP recorded by PrestaShop with the IP recorded by the upstream reverse proxy, load balancer, or CDN and alert on mismatches
Inspect X-Forwarded-For header contents at the edge and flag requests where the client-supplied portion contains internal, loopback, or allowlisted addresses
Baseline maintenance mode access attempts and alert on any successful entry outside change windows

Monitoring Recommendations

Enable verbose logging on the reverse proxy or CDN to capture the raw client IP alongside the forwarded header chain
Forward web and proxy logs to a centralized analytics platform for cross-source correlation
Monitor administrative and maintenance endpoints for access from previously unseen IP ranges

How to Mitigate CVE-2026-84186

Immediate Actions Required

Apply the PrestaShop security update that corrects Tools::getRemoteAddr() header parsing once available from the vendor
Configure the upstream reverse proxy, load balancer, or CDN to strip or overwrite inbound X-Forwarded-For headers before forwarding
Restrict direct network access to the PrestaShop origin so that requests can only arrive through the trusted proxy
Review recent access to maintenance mode and IP-restricted areas for signs of prior exploitation

Patch Information

Consult the INCIBE Security Notice and the PrestaShop project channels for the fixed release addressing CVE-2026-84186. Apply the patched version across all storefront and staging environments.

Workarounds

Terminate all client traffic at a trusted proxy that sanitizes X-Forwarded-For and injects a single authoritative value
Enforce IP allowlists at the edge (CDN, WAF, or load balancer) rather than inside the PrestaShop application
Disable reliance on Tools::getRemoteAddr() output for security-sensitive decisions until the patch is deployed

bash

# Example: Nginx configuration to sanitize X-Forwarded-For at the edge
# Only trust the real client IP from the direct upstream connection
set_real_ip_from 10.0.0.0/8;
real_ip_header X-Forwarded-For;
real_ip_recursive on;

# Overwrite any client-supplied X-Forwarded-For before proxying to PrestaShop
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Real-IP $remote_addr;