Critical severity · published Apr 24, 2026
CVE-2026-41473
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
9.1
CVSS
0.8%
EPSS
No
On KEV
Description
CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CY
cyberpanel · usmannasir
before 2.4.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-41473
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-41473
github.com
https://github.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5f
Exploit
https://itsrez.re/post/cyberpanel-rce
Third Party Advisory
https://www.vulncheck.com/advisories/cyberpanel-unauthenticated-api-access-via-ai-scanner-endpoints
More from cyberpanel
9.8
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
8.8
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
8.8
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
8.8
CVE-2026-65917
CyberPanel IncBackups IDOR via Sequential Backup ID
8.1
CVE-2026-65916
CyberPanel Missing Authorization in cancelBackupCreation Handler
