by Kastro
Paper/Archive/CVE-2026-41473

CVE-2026-41473

usmannasir cyberpanel — CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

EPSS 0.8%public exploitCVSS 9.1
critical.is priorityof 100
49
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 56.3.563 × 2011.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

Affected

ProductAffectedFixed inSource
cyberpanel< 2.4.52.4.5CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploititsrez.re/post/cyberpanel-rcepatchgithub.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5fwriteupvulncheck.com/advisories/cyberpanel-unauthenticated-api-access-via-ai-scanner-endpoints