CVE-2026-84186 PrestaShop CVE debrief

Who should care

Defenders managing PrestaShop instances, especially those using reverse proxies or CDNs, should assess exposure and verify the effectiveness of current IP-based security controls. Operators of affected PrestaShop deployments should prioritize verifying instance configurations and assessing potential security risks. Vulnerability management and security teams should review and update their security controls to address potential IP spoofing and log forgery.

Why it matters

CVE-2026-84186 allows unauthenticated remote attackers to spoof IP addresses in PrestaShop, potentially bypassing security controls and forging logs. Defenders should verify exposure, especially for instances using reverse proxies or CDNs, and assess current IP-based control effectiveness.

• Bypassing IP-based access controls, such as maintenance mode allowlists.
• Forging security and audit logs.
• Evading third-party mechanisms relying on IP addresses, like geolocation checks or fraud detection.

Technical summary

The Tools::getRemoteAddr() function in PrestaShop incorrectly processes IP address strings, allowing an unauthenticated remote attacker to spoof their IP address via the X-Forwarded-For header when the application is behind a reverse proxy, load balancer, or CDN. This could enable attackers to bypass IP-based controls like maintenance mode allowlists and forge security and audit logs. Affected PrestaShop deployments using reverse proxies or CDNs are at risk of IP address spoofing and potential security control bypass.

Defensive priority

Defenders should prioritize verifying exposure of PrestaShop instances to untrusted networks, especially those using reverse proxies or CDNs, and assess the effectiveness of current IP-based security controls.

Recommended defensive actions

• Verify PrestaShop instance configurations, especially those using reverse proxies or CDNs.
• Assess the effectiveness of current IP-based security controls.
• Monitor for potential IP spoofing attempts and log forgery.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in PrestaShop's Tools::getRemoteAddr() function. However, specific affected versions and remediation steps are not provided in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.